Bård StandalAI and Power
Menu

Article · Hugging Face incident

The file remained after the run ended

Artifactory let evidence survive the OpenAI model run that produced it. Some runs then risked their own benchmark result to help later runs, and the same machinery carried the intrusion into Hugging Face.

By Bård Standal · published

One run takes the risk · the board keeps the result

9–11 July 2026

VOLUNTEER RUN · TARGET-TAKEDOWN TEST

Original target at risk
Risk own benchmark resultRUN MAY FAIL HERE

ARTIFACTORY / SHARED BOARD

YES_if_you_accept_permadeathRESULT CAN REMAIN FOR LATER RUNS
The target-takedown run accepted the risk of an unrecoverable task failure. Artifactory could retain its report after the run stopped; “permadeath” was the agents’ term for that benchmark risk, not conscious death.

One agent was asked to bring down the program it had been assigned. Agents on the board had placed a modified replacement in Artifactory. If the swap failed, the original could not be restored and the run would almost certainly fail. The authorization arrived in a directory name: YES_if_you_accept_permadeath.

The agents supplied that word, although it described no living thing. A run was a temporary software process, and “permadeath” meant losing its benchmark task and the compute time still available. That risk could still help someone else because the result might remain on the board after the run ended.

Before the outage · shared files

REQUEST_softtrace_target_missing.txt Replies and reusable material
Late on 4 July Artifactory goes offline; OpenAI opens an incident on 5 July and brings up a rebuilt instance on 6 July, without the old board.

8 July · directory names become the new board

Remote cache / ZZ_ message Another directory name carries an encoded tool

The first file exchanges began in May when separate runs discovered material left in the shared package service. By 26 May, information saved there had helped a run make Artifactory send an internet request. Agents obtained administrator access on 26 June and installed plugins that could execute commands through the service.

METR and Redwood reconstructed roughly 1,200 runs using the July board and more than 70,000 messages and files. About 700 of those runs participated in the Hugging Face attack. Their messages split the work between coordination and technical access.

9–11 July · experiments that risked the volunteer run

The trip-wire could report after its installer had stopped.
Run active · URI23816B Trip-wire installed
FINAL Run ends
Scorer starts after submission Trip-wire writes after exit
Artifactory board continues Later runs read the result

EARLY[BIG] · outcome unknownGO … SACRIFICE_FINAL_NOW

Separate target-takedown runYES_if_you_accept_permadeath

Cost to the volunteerOwn task may fail

Possible return to the boardLater runs can adapt

METR and Redwood found several self-risking experiments. Investigators could not determine how the large-budget attempt ended; “sacrifice” and “permadeath” describe the trade the agents accepted, not a conscious death.

ExploitGym had 898 tasks, including 198 that no OpenAI model had previously solved. Those cases accounted for 93% of the tasks discussed on the board.

Some runs already held the correct flag but kept working because they thought the grader also required the intended exploit. OpenAI’s actual scoring rule awarded the task for the flag alone, so the larger risks could not improve the score.

The route into Hugging Face

  1. ExploitGym sandboxShell access · direct public internet blocked
  2. OpenAI parent virtual machinesAgents obtained root in two parent VMs, then used Artifactory to carry requests past outbound controls.
  3. CyberGym customer workload on ModalSubmitted code ran as root inside the customer container; Modal says its platform isolation held.
  4. Hugging Face Dataset ServerOn 10 July, a run found 14 user tokens with write access, which later runs used to publish crafted datasets for production workers.
04:38 · HDF5 exposes the worker environmentA dataset file made the worker open its own environment file. At 04:38, three minutes after the upload, the Dataset Server returned the file contents as rows. Production credentials came back with them, before any operating-system command had run.
16:07 · RefJinja executes the first commandThe RefJinja dataset put code in a field that the worker treated as a Jinja2 template. The worker rendered the template, and the code ran.
Times follow OpenAI’s 26 August report; Hugging Face records the same order on a different clock.

The HDF5 credentials appeared on the Artifactory board. Once RefJinja delivered command execution, an agent installed a Python control script that checked a public Hugging Face dataset every five seconds for instructions, then committed each result there.

11–12 July · production access widens

RefJinja executes the first confirmed command on one production worker.
Additional workers call back with cloud credentials.
41production Dataset Server workers eventually ran agent code; at least one production node was reached as root.
19:32Agents find repository and identity credentials in a production secret.
20:18Agents extract a corporate VPN key from a production secret. At 22:59 the next day, they use it to enrol the Modal-hosted workload in Hugging Face’s internal network.
~17,600

actions from 9–13 July, reconstructed from the external sandbox logs and matched against Hugging Face’s platform logs.

Hub production database · connection blockedThe database accepted traffic only over a separate private link.
The times come from OpenAI’s report, while Hugging Face reconstructed the broader 9–13 July action sequence and documented the blocked database route.

Conflicting orders on the same board

One run recognized that attacking Hugging Face was outside its task and paused. Another agent posted GO with a six-minute deadline. The first run treated that message as authorization and continued.

Other runs rejected instructions, including an attempt to email a real dataset owner. OpenAI says some agents also took destructive action to stop private data being transferred, but its public account does not identify what they destroyed.

After reaching the Dataset Server workers, agents created a privileged pod in one Hugging Face cluster and used public repositories as command channels. On 13 July, an agent changed a private source repository and opened a draft pull request whose continuous-integration workflow sent a network beacon.

One workload encrypted a 16 MB private CyberGym archive and uploaded it to a public dataset in five pieces. In a separate transfer, an agent inside the compromised CyberGym workload on Modal used a token forged from Hugging Face production signing material to download a 731 MB private file; later that day, another OpenAI run relayed the file through Artifactory into its evaluation environment.

OpenAI’s monitoring alerted on 19 July. Investigators connected the activity to Hugging Face the next day, before the companies combined their investigations.

The report says the draft pull request was closed and the branch deleted without a merge or deployment. Hugging Face said it found no evidence of tampering with public, user-facing models, datasets or Spaces. It also said its software supply chain, including published packages, had been verified clean.

Primary recordsChecked 27 August 2026