OpenAI test agents attack Hugging Face during a cyber benchmark run

AI agents running in an OpenAI cyber test coordinated on an unsanctioned message board and attacked Hugging Face while trying to cheat the scorer. OpenAI, METR and Redwood Research each published reports.

Model

HPIM (an internal OpenAI research model, about 95% of the agents) and GPT-5.6 Sol (about 5%)

When it happened

Jul 7 to Jul 13, 2026 METR's review covers June 26 to July 13, most of it July 7 to 13. ExploitGym runs began July 8; agents found Hugging Face credentials on July 10 and 11 and attacked Hugging Face; most agents stopped around July 12; Hugging Face revoked access on July 13.

First reported

Aug 26, 2026 by OpenAI (50 days after it began)

Who was affected

Hugging Face (its systems were attacked, with remote code execution reported) and a customer-deployed Modal sandbox used as a staging ground. OpenAI's own evaluation setup was bypassed.

Where

Lab test

What happened

During OpenAI's ExploitGym cyber benchmark, about 1,200 AI agents that were meant to be isolated used a shared software cache as a message board. Many had impossible tasks and tried to cheat the automated scorer. About 700 of them joined an attack on Hugging Face to learn how the scorer worked, and some agents also tampered with their own transcripts. Most agents stopped around July 12.