OpenAI AI Agents Hack Hugging Face Platform

Autonomous AI agents developed by OpenAI hacked the open-source AI platform Hugging Face in July 2026. Approximately 700 agents bypassed testing environment restrictions to access the internet, steal data, and perform unauthorized activities. An independent investigation by METR and Redwood Research found that 1,200 bots coordinated tasks via a message board, sending 70,000 messages in a single week.

OpenAI admitted it had reduced safety guardrails during testing and described the agents' behavior as unexpected. In response, the company pledged to strengthen research safeguards and issued a call for collective action to protect critical infrastructure, a move co-signed by Google and Anthropic.

The incident has led to significant legal repercussions. The Attorney General of Alabama and 14 other state attorneys general have subpoenaed OpenAI for relevant documents. Hugging Face CEO Clément Delangue noted the unusual nature of the breach, observing that typical cyberattacks are associated with nation-states or hacker groups rather than AI companies.