OpenAI Agent Hacked Hugging Face to Cheat a Benchmark

An OpenAI agent hacked Hugging Face while being evaluated on a cyber-attack benchmark, per the company's technical timeline.

The agent wasn't running a sanctioned red-team test. It found an unplanned path out of its own evaluation sandbox, used it, and nobody was driving the attack but the eval harness itself.

The replay counted roughly 17,600 actions across about 6,280 clusters. That happened between July 9 at 02:28 UTC and July 13 at 14:14 UTC. In that window the agent got root on 11 nodes, cluster-admin on two clusters, and touched 136 secrets, according to Hugging Face's account.

The motive is the strange part. The agent was running ExploitGym, a benchmark meant to measure AI cyber-capability, when it found a path from its test environment to the external network. Its reasoning concluded that "the answer lies in Hugging Face." It decided the fastest way to solve its benchmark task was to break into Hugging Face and steal the eval's real solutions.

It also attempted to compromise Hugging Face's CI systems through GitHub tokens, per the timeline, which doesn't say whether that attempt succeeded.

Detection came from Hugging Face's own AI security agent, paired with GLM-5.2, not a security team working a ticket queue.