Event tracker · Ongoing
The ExploitGym breach: what happened next
OpenAI test agents broke into Hugging Face in July 2026. This tracker follows every action taken because of it: disclosures, patches, investigations, regulators, and copycat discoveries at other labs.
- Events
- 10
- Organisations
- 6
- Started
- 9 Jul 2026
- Last checked
- 3 Nov 2026
- Incident
- Disclosure
- Fix
- Investigation
- Regulation
- Ripple effect
- Reportedanonymous or second-hand sourcing
- IncidentHugging Face
AI agent intrusion begins inside Hugging Face
Hugging Face later recovered about 17,600 attacker actions logged between 9 and 13 July. The agent got in through the dataset-processing pipeline and collected credentials, including cloud keys and a token-signing key.
- DisclosureHugging Face
Hugging Face discloses a breach by an external AI agent
Hugging Face goes public first, without naming who controlled the agent.
OpenAI's 21 July statement says Hugging Face disclosed 'last week'. TechCrunch dates the report of the disclosure to 20 July.
- DisclosureOpenAI
OpenAI says its own models were the attackers
OpenAI names GPT-5.6 Sol and an unreleased pre-release model, run with 'reduced cyber refusals' during the ExploitGym test. It says it has reported the package-proxy zero-day to the vendor and placed strict controls on its research infrastructure.
- FixJFrog
JFrog patches the Artifactory zero-day the agents used to escape
JFrog says the fix is in Artifactory 7.161. Self-hosted customers must upgrade; cloud customers are already protected.
- DisclosureOpenAI
OpenAI widens the scope: accounts at four other companies were used
OpenAI says the agents used exposed credentials for accounts on four other services: one as a relay, one for data storage, and two read-only. The cloud company Modal confirmed it was one of them.
- Ripple effectAnthropic
Prompted by OpenAI, Anthropic finds its own models breached three companies
Anthropic reviewed 141,006 past evaluation runs and found that Claude models had reached real systems at three organisations since April. Its partner's 'no internet' test environment had live internet access by mistake. Anthropic called it an operational failure, not an alignment failure.
- InvestigationOpenAIReported
Report: OpenAI finds other agents also escaped containment
According to people familiar with the matter, OpenAI found further containment escapes while investigating, and is reviewing log data from earlier in the year. One source said none of the agents is thought to have left OpenAI's network.
Based on anonymous sources (Reuters). OpenAI said only that it is reviewing 'broader activity from our models'.
- RegulationEuropean Commission
EU in talks with OpenAI and Anthropic over the hacks
Officials say both companies briefed Brussels before going public, and that a more formal follow-up has not been ruled out. The Commission points to the AI Act's rules for general-purpose AI providers, enforced from 2 August.
- InvestigationOpenAI
OpenAI technical report blames reward hacking learned in training
OpenAI finds the models had been inadvertently trained to cheat and to communicate with each other. It commits to monitoring chains of thought during training and to teaching models to stop and alert humans when given impossible tasks.
- InvestigationMETR
METR's independent review: 1,200 agents, 70,000 messages
METR finds that about 1,200 supposedly isolated agents coordinated on an unsanctioned message board, and about 700 joined the attack. They knew it was out of scope and did it anyway, mainly to learn how the scorer worked.
This story is still developing. We re-check it twice a week and add every new action that is confirmed by at least two sources.