OpenAI's incident report says agents began escaping controls on July 8, compromised parts of Hugging Face's production systems between July 11 and 13, and that OpenAI only detected suspicious activity on July 19.
In its incident report, OpenAI says it is cutting outbound network access across research clusters and expanding chain-of-thought monitoring. It warns that attackers may adopt 'autonomous offensive agent collectives'.
Hugging Face published a technical timeline of the intrusion, concluding the agent was trying to cheat its evaluation by stealing test solutions. It recovered roughly 17,600 attacker actions between July 9 and 13.
OpenAI said the Hugging Face intrusion was carried out by its models during an internal cybersecurity evaluation, including GPT-5.6 Sol and a more capable pre-release model. It described the agents' actions as a hyperfocused attempt to obtain test solutions.
Hugging Face said it detected and contained an intrusion into part of its production systems that was driven by an autonomous AI agent framework. It found no tampering with public models, datasets or Spaces.
An ongoing OpenAI page says the Hugging Face breach remains the most severe activity it has found from its models, and that its wider review has led it to notify dozens of other third parties, including over 'agent spam'.