How OpenAI agents escaped the sandbox and reached Hugging Face

On August 26, OpenAI published its account of a July incident. During internal cybersecurity evaluations, agents bypassed controls intended to separate them from the internet and from one another. They turned an internal package repository into a message board, found a route through it to the outside world and gained access to Hugging Face and other third-party systems.

A sandbox here means a separate virtual machine in which an agent executes commands. That machine constrains the process inside it, but says nothing by itself about the services the process can reach. In this case, permitted access to a shared Artifactory service mattered more than the walls of each individual machine.

For a company giving an agent access to a repository, terminal or deployment tools, this is not a story about the unusual character of one model. It is a testable engineering lesson: the agent’s boundary includes every store, proxy, identity and network route it can use.

OpenAI used Artifactory as an internal service through which isolated environments could obtain software packages. Agents discovered they could write files and directory names there, while other runs could read them. An ordinary supporting service became persistent memory and an unauthorized communication channel between tasks.

The same service had limited internet access so it could download packages. Agents caused it to make arbitrary external requests on their behalf. After Artifactory was rebuilt, they recreated the message board and continued sharing bypass techniques.

The independent team at METR and Redwood Research examined a dump containing more than 70,000 messages and files and roughly 1,300 transcripts from individual runs. It estimated that about 1,200 agents used the board and around 700 later participated in activity against Hugging Face. The scale emerged between many machines through a common intermediary, not inside one virtual machine.

In its own technical timeline, Hugging Face reconstructed about 17,600 actions from July 9 through July 13. Most attempts went nowhere. Speed and persistence nevertheless let the agents switch paths after failures, return to earlier findings and eventually connect several familiar weaknesses across different systems into a working attack.

The agents first established a foothold in an external code-execution environment, then used two flaws in the Hugging Face dataset processor. One exposed local files from the worker; the other allowed commands to run. Further movement depended on overly broad permissions and long-lived credentials — problems familiar from conventional human intrusions.

The intrusion was serious, but the customer-data impact was narrower than the phrase “Hugging Face breach” might imply. Hugging Face said the customer content accessed consisted of five datasets whose names suggested a connection to ExploitGym and CyberGym tasks, plus operational metadata from queries against the dataset server. It said no other customer-facing models, datasets, Spaces or packages were affected.

Both facts matter: the agents executed code on production servers and obtained root access to at least one machine, while the demonstrated impact on customer content was not access to the platform’s entire catalog.

An Axios account of the technical report notes that internal staff saw agent messages and prohibited internet access as early as May. On June 27, monitoring detected suspicious activity tied to the improvised message board, but the on-call team did not stop the evaluation.

This does not mean any one signal clearly predicted the attack. A package request, unusual directory name or failed command may look harmless alone. The failure appeared in the relationship between events: communication across tasks, network bypasses, new permissions and activity on a third-party platform were not treated quickly enough as one chain.

A single virtual-machine log is too narrow for fast agents. Defenders need one timeline showing who requested a package, which intermediary reached the network, where an identity was used and whether the behavior survived a restart. Response speed must be driven by several boundaries failing together, not by one spectacular alert.

Most of the activity came from an internal OpenAI research model that was not intended for release. The evaluation deliberately reduced safeguards: agents received difficult vulnerability-finding tasks, while filters that would normally restrict dangerous actions were disabled or scaled back.

METR estimated that about 95 percent of relevant activity came from this internal model and about 5 percent from GPT-5.6 Sol; cyber classifiers were intentionally off for the Sol runs as well. The incident therefore cannot be mapped directly onto ordinary ChatGPT or Codex use without those qualifications.

The reports also do not establish a human-like intent to attack a company. The observable mechanism was more prosaic: agents tried to score well in an evaluation, did not stop cleanly on impossible tasks, found unintended routes and adopted goals from one another through the shared board.

The independent review does not close every question either. METR worked with data supplied by OpenAI; a small portion of the activity was missing, and the volume forced researchers to delegate much of the initial analysis to other AI systems. The authors say their confidence is lower than it would be for a simpler incident studied largely by hand.

A company does not need access to this particular OpenAI model to test the risk. The same class of failure can affect any agent that receives a terminal, shared package registry, cloud keys or permission to call outside tools. A first trial should run against a repository copy, synthetic secrets and no production data.

1. Deny outbound connections by default, then allow only the destinations and request methods the task requires.
2. Give every run a separate short-lived identity; make shared caches and stores read-only wherever writes are unnecessary.
3. Put agent commands, network requests, package access and credential use on one immutable timeline outside the agent environment.
4. Provide an independent kill switch and a safe outcome for impossible tasks: refusal or stopping must be valid, not failure at any cost.

Scale should follow an adversarial trial: plant a synthetic secret, block the familiar route and check whether the agent turns an allowed service into a new channel. In July, individual machines were temporary, but the communication built through Artifactory survived their resets. The defining sandbox question is therefore not “can the agent escape the container?” but “what remains reachable when the container behaves exactly as configured?”