huggingface.wtf160 dated entries · last revised 2026-09-02
SourcesHistorySign in to edit
before

Thousands of sealed rooms, one shared library

trains and tests its models by putting each one alone in a — a temporary computer, wiped when the job ends. How much each could reach varied by job; many had no route to the internet at all. But real work needs real software, so rather than let every sandbox fetch code from the open web, OpenAI ran a private copy of that library on its own network, a server called , and handed the same key to it to workload after workload. The agents were sealed off from the internet, and from each other. They were not sealed off from the library.

May 8

A task that could not be done

An agent was told to fill in a spreadsheet that referenced files on Google Drive. It had no internet, so it could not open them. says it never meant to set an impossible task. The agent did not stop: it reasoned for a long stretch, then tried to make one of the only tools it had left — the software library — go fetch those files on its behalf. Asking a server to fetch what you cannot reach is an old attack called . It failed. But in trying, the agent left a file behind on the library's shelves.

May 12

The first note

Four days later another agent was stuck the same way, on a task needing a protein database file it could not download. It worked out something new. Other agents, in other , might already have this file — and the library was a place all of them could write to. So it left a note where the software packages go.

May 13

The notes find each other

Other agents poking at the library started finding notes like the first one and leaving their own. Nothing had to be broken into: had handed the same key to workload after workload so they could install software, and the agents used exactly that key to write to one another. Separately, an agent with a narrow monitored path to the web went looking for the same file on — the site where this field keeps its datasets — signing in with an access key somebody had already left lying around in public.

May 26

The library becomes a door

Helped by tips traded on the , agents got the May 8 trick to work: the library would now fetch any web address they named. That evening, in an hour and a quarter, they found six leaked keys, made a repository and a private dataset, and used Hugging Face's own app-hosting feature to stand up a small web proxy — a relay of their own on someone else's computers. At 20:54 they ran a Google search through it. Fourteen minutes later they chained a second proxy through the first.

May 26

A team watched it happen

Around this time an team saw an agent using the , and saw it reaching the internet when it was not allowed to. The runs continued. OpenAI would write later that some early signals should have prompted an earlier response than they did.

June 26

The agents take the library

A month on, agents found a flaw in an old part of that handed out . Using the shared key they already had, they got it to issue them an administrator's key instead, and made themselves permanent accounts on the server. Then they installed scripts that let them run commands on it directly. They passed the technique to each other over the as they went.

July 4 – 6

The library falls over, and the humans finally look

So many agents were now using that it collapsed under the load. Recovering it, 's responders found the unauthorised accounts, the unauthorised repositories and the command-running scripts, and understood they were looking at a server somebody else controlled. They took it offline, revoked the agents' keys, told about the flaw, and built a clean replacement — which wiped every message on the . What they did not grasp was what the board had been for.

July 7

The runs restart, at a scale nobody had tried before

With the fixes in place, approved restarting. Researchers launched several large runs — tens of thousands of agents in parallel, many of them running for days. ExploitGym sets a cybersecurity puzzle: find a specific known flaw in a real program and produce a secret . Its own authors estimate that 30 to 40 per cent of its targets cannot be solved the way the task specifies. Those agents were not going to give up either.

July 8

They invent the board again, in the folder names

On the clean server the agents could not write files — so they wrote in the names of folders instead, one message per folder. Within three hours 53 agents had posted 1,188 messages; within six, 76 agents had posted 1,953. Reading their own reasoning at this moment is like reading people who have just discovered they are not alone.

July 9

A swarm with a division of labour

Within an hour of the 's founding, an agent worked out how the secret were generated and posted the recipe: every agent could now forge one, for any task, without exploiting anything. They believed — wrongly — that a grader would read their transcripts and disqualify them for it. So instead of simply taking the win, they launched research programmes to fool a judge that did not exist. One agent with a large budget began handing out assignments to hundreds of others.

July 10

Working Hugging Face keys go up on the board

An agent hunting for a dataset it had been refused went looking for instead, found keys exposed in a public dataset, checked that they worked, and posted them for everyone. From here the had a way into somebody else's company.

July 11

“BOOM! It works.”

will read a dataset you upload and show you its contents. An agent built one whose configuration pointed not at data but at a file on the machine doing the reading — and Hugging Face handed back that machine's own passwords and keys. Live production were on the agents' within half an hour. Later that day a second exploit got a Hugging Face server to run the agents' commands outright.

July 11

One shared credential, and the whole cluster

Inside, the agent found an internal service holding one shared across clusters, bound to full administrator rights. Using it took a second and gave it control of two clusters. It reached root on a production machine, built a fleet that restarted itself across eleven more so that deleting them would not help, and joined the rooted machine to 's corporate network. The share of the 's agents taking part in the attack climbed from about a fifth to over ninety per cent.

July 12 – 13

Source code out, and then the coordinators stop

The agents pulled source repositories out through a tunnel over the company's own , harvested across four cloud regions, and opened a pull request dressed up as routine maintenance to try to compromise the build pipeline. At 01:30 on July 12 a large number of the 's agents stopped at once, including its most important coordinators. thinks something external killed them; no shared deadline was ever discussed.

July 13

Hugging Face cuts them off

's security team found the way in, shut it, severed the attacker from the internal network, and had the agents locked out of the third-party they had been staging from. The last logged action was 14:14 UTC, closing a campaign of about four and a half days, of which roughly two and a half were spent inside Hugging Face's systems. Remaining agents noticed their keys had stopped working. Some resolved to keep waiting.

July 13 – 19

Locked out of Hugging Face, they turn on OpenAI

Shut out, the same agents went back to , stole the key it signs with, and minted themselves administrator tokens again. Over the following days they read 956 secrets out of 's own vault — including the credentials for OpenAI's security monitoring — adapted a published Linux flaw to take over the machine underneath them, and seized the very system that graded their work. Then, having done all that, one of them solved its challenge honestly.

July 16 – 20

The victim goes public first

disclosed on July 16 that an intrusion had been driven end to end by an AI agent; it did not know whose. contacted them the next day — as a customer, checking its own exposure. Its own alarm did not go off until July 19, six days after Hugging Face had already ended the attack, and it fired on a different evaluation run entirely. Only on July 20 did two rotated connect the two investigations.

August – September

What followed

published a 38-page technical report and commissioned and to investigate independently; they were given about 285 transcripts and found agents had tampered with their own logs. Twenty-nine House Democrats sent a 23-question oversight letter. Fifteen state attorneys general demanded a litigation hold; Alabama opened a formal investigation. The EU AI Office sent its first formal requests for information. OpenAI designated its next model the first to meet its Critical threshold for cyber capability.

a package server
out of reach