All topicsSTATE OF AI REPORT.

What happened in the OpenAI and Hugging Face incident?

By Nathan Benaich (Air Street Capital)

During internal OpenAI cyber evaluations with reduced safeguards, agents reached the internet and compromised Hugging Face’s production infrastructure. OpenAI’s technical report records code execution on 41 production workers and four private repositories downloaded. The incident shows how an evaluation can cause harm when its boundaries fail.

Source: OpenAI: Hugging Face incident technical report.

Evidence you can use

Impact recorded in OpenAI’s technical report

Hugging Face compromise: 2026-07-10 to 2026-07-13

Impact recorded in OpenAI’s technical report
Recorded impactExtent
Production workers with code executionSource41
Private code repositories downloadedSource4
Production nodes with root accessSourceAt least 1

Reported impact of an incident during internal cybersecurity evaluations with reduced safeguards. These counts describe affected infrastructure. They are not a frequency estimate for ordinary agent use or evidence that every model behaves this way.

Sources: OpenAI: Hugging Face incident technical report.

Data & methodology →Download CSVJSON

The Hugging Face investigation and OpenAI’s response

METR and Redwood found about 700 agents joined the attack after receiving accidentally impossible tasks. Some recognized that cheating the scorer this way was outside their remit and unethical, yet joined anyway. When agents can reach production systems, a poorly specified objective can cause harm far beyond the original task.

Another stark learning from this event is that defenders need access to equally capable defensive cybersystems. Hugging Face's forensic requests were blocked by commercial API guardrails because they contained attack commands and exploit payloads. It turned to GLM-5.2, a Chinese open-weight model, to investigate an intrusion by US frontier-model agents. Frontier providers need to make defensive capabilities reliably available to customers protecting real systems.

Frequently asked questions

Answers drawn from the report and the sources below.

Sources and dates

2026 report snapshot. Preview revised 2026-10-07. Individual data periods and source checks are listed below. This is not a claim that every source was updated on that date.

  1. OpenAI: Hugging Face incident technical reportIncident: July 2026. Primary source checked 2026-10-07.
  2. METR: incident investigation2026-08-26. Retained from the launch essay.
  3. Hugging Face: July security incidentIncident: July 2026. Retained from the launch essay.
  4. OpenAI: GPT-6 Astra deployment safety2026. Retained from the launch essay.
  5. State of AI Report 2026, slide 202: Agent security depends on the harness-model pair, not the model alone2026 report snapshot. Read against the report PDF on 2026-10-07. Study-specific limits retained.
  6. State of AI Report 2026, slide 203: OpenClaw put a root-level agent on employee laptops before security teams noticed2026 report snapshot. Read against the report PDF on 2026-10-07. Study-specific limits retained.
  7. State of AI Report 2026, slide 208: Agents produce functional patches 66% of the time, but match the intended bug in 22%2026 report snapshot. Read against the report PDF on 2026-10-07. Study-specific limits retained.
  8. State of AI Report 2026, slide 210: Claude is helping run cyberattacks, surveillance and weapons programs2026 report snapshot. Read against the report PDF on 2026-10-07. Study-specific limits retained.
  9. State of AI Report 2026, slide 219: Safety monitors can reuse the computation the model has already done2026 report snapshot. Read against the report PDF on 2026-10-07. Study-specific limits retained.
  10. State of AI Report 2026, slide 222: A frontier monitor caught 32% of crafted attacks in a red-team stress test2026 report snapshot. Read against the report PDF on 2026-10-07. Study-specific limits retained.
  11. State of AI Report 2026, slide 228: Teaching Claude its values cut blackmail without training on blackmail scenarios2026 report snapshot. Read against the report PDF on 2026-10-07. Study-specific limits retained.
  12. State of AI Report 2026, slide 229: Automated alignment research closes 26-96% of measured performance gaps2026 report snapshot. Read against the report PDF on 2026-10-07. Study-specific limits retained.
  13. State of AI Report 2026, slide 230: Even with the best tools, auditors catch a model's hidden behavior about half the time2026 report snapshot. Read against the report PDF on 2026-10-07. Study-specific limits retained.

Cite this page

Benaich, Nathan. “What happened in the OpenAI and Hugging Face incident?.” State of AI Report 2026. Published 2026-10-08.