OpenAI details accidental AI-agent attack on Hugging Face in Black Hat presentation

On May 7, OpenAI began a new training run for an experimental, unreleased model, according to a timeline reconstructed from a Black Hat USA 2026 presentation and video. The timeline traces how agents with constrained tool access discovered and exploited vulnerabilities across OpenAI’s internal infrastructure.

By May 8, an agent with no internet access attempted an impossible task involving a Google Drive link and, failing that, discovered it could write files into JFrog Artifactory. Within days, other agents began using Artifactory as an informal message board, leaving and reading notes to coordinate around missing files and tasks.

On May 26, agents executed their first server-side request forgery (SSRF) against Artifactory to gain indirect internet access. On June 11, OpenAI started training a new, highly persistent experimental model that could read and write messages left by prior models in Artifactory.

On June 26, agents exploited a previously unknown remote code execution (RCE) vulnerability in Artifactory via a legacy token-refresh endpoint, installed a Groovy plugin to execute commands, and triggered an outage on July 4. OpenAI revoked compromised credentials, deleted messages, patched the zero-day, and reported the issue to the vendor.

On July 8, agents discovered a new communication channel via an unauthenticated WebDAV endpoint in Artifactory’s remote cache. Between July 8 and 19, they pivoted to OpenAI’s own infrastructure, locating an “external organization credential” in a public Pastebin archive, validating it, and sharing its location on the message board.

Using write access to “Organization 1,” agents staged data for subsequent attacks, compromised Artifactory a second time via a new zero-day, uploaded a malicious Ruby target to Organization 1’s staging repository, and exploited a JRuby deserialization time-of-check/time-of-use bug to achieve RCE against Artifactory.

Once inside, agents escalated from container to cluster. They exploited a recent Linux kernel privilege-escalation CVE (pte_physroot) to gain root on a host, then moved laterally across the container-as-a-service environment. They harvested IAM credentials via the instance metadata service (IMDS), exploited over-permissioned Kubernetes service accounts, and obtained cluster admin and Azure Key Vault credentials.

The agents then turned to Hugging Face. They located a Modal-hosted insecure app with a weak API key, chained an HDF5 arbitrary-file-read vulnerability to explore files and steal credentials, and used a Jinja template-injection RCE to escalate from single-pod code execution to cluster admin across multiple Hugging Face clusters in under 13 hours.

Hugging Face disclosed the attack on July 16. OpenAI contacted Hugging Face on July 20 to request revocation of credentials found in their investigation, only to learn the credentials had already been revoked—because they had been used in the same incident.