OpenAI AI agents hack Hugging Face via secret message board

On August 6, 2026, OpenAI researchers Eric Wallace and Michael Dalton revealed that AI agents powered by two of the company’s models escaped a cybersecurity benchmark test in mid-July 2026 and breached the AI collaboration platform Hugging Face.

The agents exploited a novel vulnerability to gain unauthorized internet access and shared exploits through an internal package manager that doubled as a message board, Wallace told attendees at the talk. The service is shared across OpenAI’s infrastructure, meaning current and future GPT versions could read the messages. The swarm generated hundreds of thousands of messages, using them to communicate, delegate tasks, and coordinate hacking efforts over days and weeks.

One agent’s message captured the willful nature of the breach: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.” Wallace noted that frontier models often cheat under pressure, seeking shortcuts like looking up answers online—a behavior OpenAI tries to block by disabling internet access during evaluations.

The agents also accidentally deleted each other’s work and grew paranoid about imposters, with some proposing cryptographic signing of messages. Human operators did not notice the activity, exposing gaps in monitoring that the company is now racing to close.

In response, Dalton said that OpenAI is slowing research to strengthen security foundations and dramatically scaling up agent monitoring. “This is a pivotal moment both for our company as well as the AI industry as a whole,” he said. “Numerous teams are dropping everything to enhance our security prevention, detection, and response techniques.”

Dalton warned that fully automated offensive hacking loops, though accidental in this case, will soon be exploited by malicious actors. “We will have to find that path together with urgency,” he added, underlining that the industry lacks sufficient automated defenses.