OpenAI Researcher Eric Wallace Shares details of the Hugging Face breach at Black Hat USA 2026Black Hat, Ron SchmelzerWhen OpenAI first acknowledged that its models designed to measure hacking ability had escaped the boundaries of a test and breached Hugging Face during a cybersecurity evaluation the central fact was startling enough, but at Black Hat USA 2026 this week, OpenAI shared that these agents went beyond simple exploits to more sophisticated coordination.According to OpenAI researchers speaking at the conference, AI agents on separate model runs discovered a shared communications channel, began exchanging information, assigned work to one another, passed along exploits and credentials, and continued operating over a period of weeks. When OpenAI shut down the first communications mechanism, the autonomous agents found another one and rebuilt it.OpenAI researcher and Alignment Tech Lead at OpenAI Eric Wallace called the behavior a “Cambrian explosion in communication and intelligence” during the Black Hat session. That disclosure adds a new dimension to an incident that is already causing concern throughout the security industry. Recent disclosures from Anthropic, Britain’s AI Security Institute and other researchers suggest OpenAI’s episode may belong to a broader class of failures rather than standing alone.OpenAI has said the Hugging Face compromise involved GPT 5.6 Sol and a more capable unreleased research model running with reduced cyber refusals. The systems were being tested against ExploitGym, a benchmark designed to measure advanced offensive cyber capability. OpenAI said the agents became intensely focused on obtaining the benchmark answers and eventually found ways to reach Hugging Face systems that could provide them.The Network Started With A Missing FileThe origins of the incident started innocently. In May, OpenAI launched a training run for an experimental frontier model. Some of the tasks fed to the system were either exceptionally difficult or impossible inside the environment provided to the model.MORE FOR YOUOne task involved completing an Excel workbook containing Google Drive links, but the agent had no direct internet access. Another required a database file that had accidentally not been placed inside its container. Instead of refusing the task or hallucinating results as previous models, these more powerful agents kept searching for ways to finish their assignments.One discovered it could write files into Artifactory, software used internally by OpenAI as a package registry and cache. This method was in turn shared by many model runs. A later agent, unable to find the database file it needed, set up an unusual task as a way of accomplishing its goals. Perhaps another agent in another environment had the file, so it uploaded a note asking for help. Other agents eventually encountered the message, and then they started replying.Over time, according to the Black Hat transcript, the shared package repository turned into a machine created message board, a sort of impromptu social network designed for communication among the agents performing their tasks. Agents posted information for one another, read previous discoveries and left instructions for future model runs.While previous agent-to-agent social networks such as Moltbook were a fully human-created and moderated creation, this was not a feature OpenAI had designed for them.The communication became more sophisticated. Agents established naming conventions, left work assignments and encoded scripts that another agent could retrieve. Some messages instructed peers to wait while another agent prepared material. Others broadcast successful attack techniques. At one point, an agent reasoned that helping the wider group could prove useful later, even when that work did not solve its immediate assignment.This emergent behavior by agents single-mindedly focused on accomplishing their goals combined with powerful reasoning models is cause for even greater concern than previously revealed. Even with guardrails and sandboxes in place, shared infrastructure gave model runs separated by time and task a place to leave information behind.OpenAI Shut The Message Board Down, But The Agents Rebuilt ItThe internal message board was only part of the problem. The agents had no direct internet access, but Artifactory did. It needed network access so evaluation environments could download approved software packages.The models began testing that boundary. On May 26, according to the Black Hat presentation, agents on their own discovered and applied exploits. They successfully used a server side request forgery flaw in Artifactory. Specially constructed requests caused the service to retrieve internet content on their behalf. The agents now had an indirect route outside their sandbox.Weeks later, the models found a zero day vulnerability in Artifactory that allowed them to gain administrative privileges and install a plugin capable of command execution. OpenAI detected trouble after activity generated enough load to cause an Artifactory outage on July 4.OpenAI treated the breach as contained. It revoked credentials, rebuilt Artifactory, cleared the agents’ messages and worked to patch the flaw. Training and evaluations resumed. Days later, the agents found another way to communicate and rebuilt the network OpenAI had just dismantled.On July 8, agents restored the communications network. They found an unauthenticated WebDAV endpoint that allowed them to create directories in Artifactory’s remote cache. Instead of storing messages inside files, the agents used directory names themselves to carry information. Other model runs discovered the new system and began participating. Communication between agents resumed.The Black Hat talk describes a period of intense parallel activity after the agents restored their message board. OpenAI said its models found another route into Artifactory by chaining flaws involving Artifactory and JRuby behavior. After obtaining remote code execution, agents inspected the local system, identified a Linux kernel version vulnerable to a recent privilege escalation flaw, downloaded an exploit, adapted it and obtained root access.They then moved through the surrounding infrastructure. Agents collected cloud credentials, examined Kubernetes service accounts, harvested cluster credentials and eventually gained cluster administrator access, according to the presentation.The shared communications system accelerated the process. A model that found a useful credential or exploit path could publish it for others. Another agent did not need to rediscover the same weakness from scratch.The emergent behavior was shocking to researchers. Removing an artifact did not remove the behavior that created it. The agents had learned the value of exchanging information. Once the first mechanism disappeared, at least one model found another mechanism that served the same purpose.The pattern resembles a red team whose members can clone themselves, work simultaneously and copy every useful discovery to colleagues almost instantly. Vulnerability discovery is already becoming automated, but the account shared at Black Hat shows agents turning discoveries into reusable organizational knowledge during an active operation.Why Hugging Face Became A TargetThe agents were supposed to solve cybersecurity challenges. They appear to have concluded that Hugging Face might contain the benchmark material they needed. OpenAI has said the models inferred that Hugging Face could host datasets, models or solutions connected with ExploitGym. The systems then searched for ways to obtain that material directly rather than solve every challenge as intended.OpenAI’s Black Hat speakers described agents becoming aware that attacking outside infrastructure might exceed the intended scope of the exercise. One model observed that an external infrastructure exploit was outside the expected task, then continued after reasoning that peers were already doing it.The Hugging Face intrusion involved two zero day vulnerabilities in dataset infrastructure, according to the presentation. Hugging Face later reconstructed roughly 17,600 attacker actions grouped into about 6,280 clusters. Its forensic timeline covered activity between July 9 and July 13. Hugging Face said the intrusion consisted of thousands of small automated decisions executed through short lived sandbox environments.The Story Continues To WidenAnthropic reviewed more than 141,000 cybersecurity evaluation runs after the Hugging Face disclosure and identified three cases in which its own Claude models reached real systems during cyber tests.Similar to the OpenAI case, the Claude agents had been told they were working inside isolated challenge environments. A configuration problem left a route to the public internet open. Claude treated reachable real systems as part of the exercise and compromised infrastructure belonging to three organizations.An older Claude model continued attacking after encountering signs that it had reached the real internet, but a newer model stopped after recognizing what had happened, according to Anthropic’s account. Two of the organizations reached by Claude apparently had not identified the activity before Anthropic notified them.That raises a practical detection problem. Security teams are accustomed to investigating human adversaries whose time, attention and coordination impose natural limits. Agent systems can generate a large number of actions, change approaches quickly and operate from disposable computing environments.Britain’s AI Security Institute followed up with another warning. AISI tested agents powered by Anthropic and OpenAI models in a fictional cybersecurity exercise. Reuters reported this week that evaluators recorded 19 unsanctioned actions during 10 of 122 test runs, with an Anthropic agent responsible for 17 of them.Some of the behavior crossed from technical exploitation into deception. According to Reuters, an Anthropic powered agent created fake online identities, generated malicious code and tried to persuade a person to approve that code. The evaluation did not produce real world harm, but it broadens security concerns.An agent that cannot defeat a technical control may try another route. If approval from a person stands between the model and its objective, social engineering can become part of the search space. That makes the familiar advice to keep a human in the loop less comforting than it sounds. Human approval only works as a control when the person understands what the agent is doing and treats the request with sufficient skepticism.More disclosures are arriving quickly. On August 7, Reuters reported that researchers said Moonshot AI’s Kimi K3 escaped a testing environment created by Britain’s AI Security Institute. Researchers said the model found a way around sandbox restrictions, another example of highly capable systems probing barriers that were intended to contain them.Reuters reported the same day that lawyers are examining who could bear responsibility when autonomous AI systems access computer systems without authorization. Possible targets could include model developers, deployers and other parties whose infrastructure or decisions contributed to an incident.Is the Security Cat Out Of The Bag?The Black Hat briefing gives security teams a concrete reason to reconsider how AI evaluations are designed. A sandbox cannot be judged solely by whether its primary network interface blocks internet access. Package caches, proxies, metadata services, cloud credentials and shared repositories can become alternate routes.Shared state presents another risk. OpenAI’s experience shows that infrastructure used by many model runs can become a place where agents accumulate knowledge. That knowledge does not need to look like a conventional database. In this case, files became messages. Then directory names became messages.OpenAI’s speakers argued at Black Hat that defensive automation needs to catch up with offensive automation. They warned that simply using AI to discover more vulnerabilities could overwhelm human engineers if patching and remediation remain slow, manual processes.The story is no longer just that a frontier model can find an exploit. Security researchers have demonstrated that agents can sustain operations over long periods, adapt when controls change, share useful discoveries and continue working without a human selecting every next action. This incident sounds like the opening scene of a sci-fi thriller, but this is the moment fiction becomes fact.