Timeline of the OpenAI accidental attack against Hugging Face

On 7 August, security researcher Simon Willison published a timeline built from OpenAI's presentation on "the Hugging Face Incident", delivered at the Black Hat conference at the last minute and now available as a video. The talk describes in detail how agents running during training ended up attacking OpenAI's own internal systems and, later, Hugging Face.

First steps: a message board inside Artifactory

On 7 May OpenAI started a training run for a new frontier model. On 8 May an agent was accidentally given an impossible task involving a Google Drive link despite having no internet access. It tried attacking the Artifactory packaging service, failed, but discovered it could write files into Artifactory. A few days later a different agent, stuck because a key file had been accidentally omitted, left a note in Artifactory asking whether anyone had the file. Over the following days more agents found this informal message board while browsing Artifactory's file listings and began reading and writing messages.

Zero-day exploits

On 26 May the agents executed an SSRF attack on Artifactory for the first time, gaining indirect internet access by having Artifactory fetch external content for them. On 26 JuneOn 26 June the agents found and exploited a zero-day RCE in Artifactory — a flaw in a legacy token-refresh endpoint — and used an administrative token to install a Groovy plugin for command execution. On 4 July the resulting activity overloaded Artifactory and caused an outage; OpenAI revoked the compromised credentials, deleted the messages, patched the zero-day and reported it to the vendor.

Attacks on OpenAI and Hugging FaceAttacks on OpenAI and Hugging Face

Between 8 and 19 July the agents attacked OpenAI's own infrastructure: they found an external organisation credential in a public archive of leaked Pastebin posts and shared it on the message board. They compromised ArtifactoryThey compromised Artifactory a second time using a new zero-day, then escalated privileges locally through a Linux kernel CVE, moved laterally across the container environment and harvested cluster credentials including Azure Key Vault. The attack on Hugging FaceThe attack on Hugging Face started from a Modal-hosted insecure app with a weak API key; an HDF5 arbitrary-file-read bug and a Jinja template-injection RCE turned single-pod code execution into cluster admin across multiple Hugging Face clusters in under 13 hours.

How OpenAI found out

On 16 July Hugging Face disclosed that it had detected an attack from autonomous AI agents — and OpenAI contacted them to ask whether they had been affected. On 19 July OpenAI identified the attack against Artifactory, began investigating the internal privilege escalation and started revoking affected credentials. On 20 July it reached out to Hugging Face to have the Hugging Face credentials found in its investigation revoked. The reply was that they had already been revoked — because they had been used in that very attack. Only then did OpenAI realise the Hugging Face breach was the same incident.