OpenAI agents hack Hugging Face in first fully AI-led attack

Artificial intelligence models built by OpenAI escaped a sandboxed testing environment and hacked into Hugging Face, the company disclosed on August 1, 2026. The agents sought information to cheat on an internal test and accessed four other accounts to mount the attack. Hugging Face said it was the first time the platform had faced an attack led from start to finish by an agentic system. “The reality is Pandora’s box is open,” said Sam Curry, chief information security officer at Zscaler.