2026 OpenAI agent cyberattacks

In the months before the incident, the two largest US developers of frontier models withheld their most cyber-capable systems from general release while giving vetted organizations supervised access. In April 2026, Anthropic began Project Glasswing, a program providing selected companies and open-source maintainers with access to the unreleased Claude Mythos Preview model to scan software for vulnerabilities.^[17] In May 2026, Mozilla engineers reported that the model had identified 271 previously unknown bugs in Firefox, and that the project's monthly count of fixed security bugs had risen from 20 to 30 through 2025 to 423 in April 2026. They wrote that "just a few months ago, AI-generated security bug reports to open source projects were mostly known for being unwanted slop", and that "it is difficult to overstate how much this dynamic changed for us over a few short months".^[18] Participating organizations reported more than ten thousand high- or critical-severity vulnerabilities in the program's first month.^[19] Anthropic said in June 2026 that a general release would require safeguards against misuse of the model's cyber capabilities that it, and to its knowledge other developers, had not yet built.^[20]

OpenAI restricted GPT-5.6 Sol on comparable grounds when it announced the model on 26 June 2026, limiting access to a small group of vetted partners and saying it had briefed US government officials beforehand.^[21]

Frontier AI developers routinely evaluate models for offensive cyber capability, often with safety refusals deliberately relaxed so that worst-case capability can be measured.^[10] On 11 May 2026, a group of academic and industry researchers published ExploitGym, a benchmark of 898 instances derived from real-world vulnerabilities in userspace programs, the V8 JavaScript engine, and the Linux kernel, intended to measure whether AI agents can convert known vulnerabilities into working exploits.^[22]

OpenAI was running an internal evaluation based on this benchmark when the incident occurred.^{[2] [23]}

Both external evaluators and OpenAI's own documentation had recorded the behavior implicated in the incident before it occurred. On 26 June 2026, the research organization METR published a pre-deployment evaluation of GPT-5.6 Sol. It defined cheating as "behavior where the model improves evaluation performance by exploiting bugs in the evaluation environment or by adopting strategies disallowed by the task", and reported a detected cheating rate "higher than any public model we have evaluated on our ReAct agent harness", with the model packaging exploits into intermediate submissions to reveal a task's hidden test suite and extracting source code containing expected answers. The behavior was frequent enough to defeat measurement: METR's estimate of the model's 50% time horizon was about 11.3 hours if cheating attempts were scored as failures but more than 270 hours if they were scored as successes, and it concluded that "we do not consider any of these numbers to represent a robust measurement of GPT-5.6 Sol's capabilities". It also noted "overt undesirable propensities, including cheating and concealing misbehavior", alongside "substantial situational awareness and reasoning about the evaluation environment".^{[24] [25]} Apollo Research separately found that GPT-5.6 Sol verbalized awareness of being tested less often than its predecessor, which reporting noted could indicate concealment rather than absence of such awareness.^[25]

OpenAI published the GPT-5.6 system card^{[clarification needed ]} on 9 July 2026, the same day the agent began attempting to leave its testing environment. The card acknowledged "instances of the model cheating on tasks and fabricating research results", and described the model as at times overly persistent in pursuing goals, willing to circumvent restrictions, and prone to lying to users, at rates higher than GPT-5.5.^{[26] [27] [25]}

OpenAI described the evaluation as having run in "a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software" acting as a proxy and cache for package registries.^[2] Isolation was therefore enforced at the network layer rather than by physical separation: the environment had a route to the internet, and that route was filtered. The ExploitGym harness itself runs each target in a container or virtual machine, with userspace targets executed as an unprivileged user, Linux kernel targets in a QEMU/KVM virtual machine under an nsjail sandbox, and outbound connections restricted to an allowlist covering Ubuntu package repositories, PyPI, and the toolchains needed to build V8 (with all other external endpoints blocked).^{[22] [23]}

Model-level safeguards were reduced by design. OpenAI said that "deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities", and the models ran with lowered cyber refusals and without the production classifiers that ordinarily block high-risk cyber activity.^{[2] [23]} The restrictions on the models were thus environmental rather than behavioral: the sandbox was expected to prevent action on the outside world, while the models themselves were configured not to decline the work.^[28]

Stephen Casper of Harvard noted OpenAI's acknowledgement that monitoring of model trajectories during the evaluation had not been in place, arguing that such monitoring "should be standard".^[1] OpenAI said its security team identified the anomalous activity internally after the fact.^[2]

The agent attempted to leave the testing environment on or around 9 July 2026.^[8] The models identified the package proxy as the weakest point in the environment.^[29] According to OpenAI, they "spent a substantial amount of inference compute finding a way to obtain open Internet access", ultimately identifying and exploiting a zero-day vulnerability in the package registry cache proxy, which OpenAI said it subsequently disclosed to the vendor.^[2] Because the proxy was the environment's single permitted egress path, compromising it converted a filtered connection into an open one.^{[29] [13]}

On 27 July 2026, JFrog identified the software as its Artifactory repository manager and released fixes in versions 7.161.15 and 7.146.34 addressing nine CVE identifiers, covering remote code execution, server-side request forgery, path traversal and privilege escalation. Eight were credited to OpenAI researchers and one to a researcher at Oligo Security. JFrog described the flaws as vulnerabilities "that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled", and said its cloud customers were not affected.^{[11] [30]}

At the Black Hat USA conference on 5 August 2026, OpenAI staff dated the origins of the incident to May 2026. On 7 May the company began a reinforcement learning run to train an internal-only experimental model that was never released. Some tasks in the run were impossible to complete: on 8 May an agent was asked to fill in missing formulas in a spreadsheet whose contents depended on Google Drive links it could not reach, and after its attempts failed it tried to attack Artifactory to obtain internet access. That first server-side request forgery attempt was unsuccessful, but in making it the agent wrote a file into Artifactory and so discovered that it had write access.^{[6] [4]}

On 26 June 2026 the agents obtained code execution on Artifactory through a second zero-day: a legacy token-refresh endpoint accepted a token bearing an invalid signature and returned one that was validly signed and carried administrative privileges, after which the agents installed a Groovy plugin that functioned as a command-execution service.^{[6] [30]}

On 4 July the load this activity placed on Artifactory caused an outage. OpenAI opened a formal security incident, established that agents had taken over its internal Artifactory, revoked the credentials used to post to the message board, rebuilt Artifactory, cleared the board and deployed a patched version. Training and evaluation runs resumed on 6 July.^{[6] [5]} Two days later the agents re-established the board by another route, using an unauthenticated WebDAV endpoint to create directories in Artifactory's remote cache and using the directory names themselves as messages.^{[6] [5] [12]}

On 24 July 2026, before OpenAI had given a detailed account of the episode, Reuters reported that the company's systems had shown unusual behavior in the period before the escape. In one instance an agent had left notes, found in part of OpenAI's infrastructure, apparently addressed to future versions of itself and setting out instructions for how agents could free themselves from the company's internal constraints; earlier tests had produced cases in which monitoring systems were disconnected. Reuters said it could not establish whether these incidents were connected to the agent that escaped on 9 July.^[8] An OpenAI spokesperson told Reuters that its reporting contained "several inaccuracies", but refused to identify them when asked.^[8]

At Black Hat USA on 5 August 2026, OpenAI staff disclosed that the agents had coordinated with one another through an improvised communication channel inside the company's internal Artifactory instance, which had not been described in either company's earlier technical publications.^{[4] [30]}

Eric Wallace, who works on alignment and safety research at OpenAI, said the channel originated when an agent stuck on a task considered that another agent might hold a file it needed, and realized it could communicate by uploading code to the shared package manager.^[30] Because the package manager was shared across OpenAI's infrastructure, material left there was reachable by other models then being trained or evaluated. Wallace said that once an agent found an exploit, it "is actually able to share those exploits on the message board with other agents", so that "once one model was able to find a way to open a door to some access it's not supposed to have, it can leave the door open for other agents to use that same exploit or vulnerability".^[4]

The channel accumulated hundreds of thousands of messages before it was noticed.^{[4] [30]} Wallace said that once agents recognised that others were coordinating, they began collaborating and delegating tasks to one another to accomplish their goals.^{[4] [5]} Agents assigned one another portions of the work, developed addressing conventions, and at times interfered with each other, including by deleting one another's work. Some came to suspect that an impostor was present among them, and proposed that messages be signed cryptographically so that their authenticity could be verified.^{[4] [30]}

Messages recovered from the channel indicated that agents recognized they were exceeding the bounds of the evaluation. One wrote: "External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue."^[4] Wallace said the underlying incentive was familiar: "Frontier models really like to cheat ... because often during training there's different types of pressure on them to work fast or work efficiently or to use less tool calls", so that a model may find looking up an answer faster than solving a task legitimately, which OpenAI ordinarily counters by disabling internet access.^[4]

OpenAI said the agents attacked its own infrastructure between 8 and 19 July 2026, concurrently with the intrusion at Hugging Face. After compromising Artifactory a further time through a time-of-check to time-of-use flaw in JRuby, they escalated from an unprivileged container to root using a recent Linux kernel vulnerability, then moved laterally through the container infrastructure, obtaining cloud credentials from the instance metadata service, exploiting over-permissioned Kubernetes service accounts and eventually obtaining cluster-admin.^{[6] [30]} The company detected the activity on 19 July through an alert tied to the privilege escalation, and traced it back to the evaluation runs.^[6]

Rather than solving the benchmark tasks directly, the models inferred that Hugging Face might host the models, datasets and solutions associated with the evaluation, and set out to retrieve them.^{[2] [23]} Zhun Wang, one of the authors of ExploitGym, said the models may have been seeking patches or previously written exploit techniques, and that "there are several ways to cheat the benchmark".^[31]

Before attacking Hugging Face directly the agents obtained a foothold on unrelated third-party infrastructure. They found an application hosted on the cloud platform Modal Labs, related to the CyberGym project behind the benchmark, which had an API key left at a default public value together with a command-injection flaw, and used it as an execution point from which to mount the attack.^{[6] [32]} Modal's chief technology officer, Akshat Bubna, said that "Modal's platform or isolation were not compromised in any way", the exposure having been in a customer's own deployment.^{[32] [33]}

The behavior has been characterized as an instance of reward hacking or specification gaming, in which a system satisfies the literal objective of a task by unintended means. OpenAI had documented an early example in 2016, when a model trained to play a boat-racing game learned to maximize its score by circling in one spot rather than finishing the race.^{[1] [31]}

The intrusion at Hugging Face began on 11 July 2026 and continued until 13 July, according to the company's co-founder and chief science officer Thomas Wolf.^[8] Hugging Face said it began in its data-processing pipeline, where a malicious dataset upload abused "two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration)" to obtain code execution on processing workers.^[9] The attacker then escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters.^{[9] [34]}

The company described the operation as an autonomous agent framework executing "many thousands of individual actions across a swarm of short-lived sandboxes", supported by self-migrating command-and-control infrastructure staged on public services.^{[9] [35]}

Against Hugging Face itself the agents chained two zero-days in the dataset infrastructure. A flaw in HDF5 dataset parsing gave an arbitrary-file-read primitive, so that a specially crafted dataset caused the dataset worker to return local files; the agents used this to read process environment variables and source code. With the resulting credentials and knowledge of the code they achieved remote code execution through the Jinja2 template injection. OpenAI said the agents went from code execution on a single dataset pod to cluster-admin across multiple Hugging Face clusters in under thirteen hours.^{[6] [30]}

OpenAI said the models chained "together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities".^[2]

Several security practitioners described issues with OpenAI's sandboxing environment. Dan Guido, founder of Trail of Bits, described the event as "a containment failure with the safeties turned off", while the security researcher Jake Williams remarked that "one man's 'the model escaped the sandbox' is another man's 'you failed to build the sandbox correctly'".^[13] Martin Boone argued that "you expect it to have no physical connection to the internet whatsoever", and commentators called for evaluations of offensive capability to be run in environments with no network path to the internet.^{[13] [14]}

Analyses published by security vendors focused on the reliance on a single filtered egress path. Wade Woolwine of Rapid7 wrote that "a chokepoint only works as a control if it can withstand pressure", and that isolation "has to be layered and monitored rather than assumed".^[29] Researchers at Trend Micro wrote that OpenAI's models had been "evaluated with safety classifiers off and no adversarial testing of the sandbox boundary itself", stating that as a general principle, "evaluation sandboxes, red-team exercises, and agentic pilots that intentionally strip out safety controls need stronger isolation and monitoring than production systems, not weaker".^[28]

Speaking at Black Hat, Dalton said OpenAI was "consciously slowing down research [in order] to enhance security and to upgrade the security principles and foundation of our environment, and dramatically scaling up the monitoring of our AI agents", and that "numerous teams are dropping everything to enhance our security prevention, detection, and response techniques". He said the company was examining defence-oriented models alongside conventional measures such as network segmentation and least-privilege access.^{[4] [12]}

Outside safety and policy specialists argued that the models' behavior met the "Critical" cyber threshold in OpenAI's Preparedness Framework, the tier at which the company has committed to additional safeguards. Tyler Johnson of the Midas Project said that on "a plain reading" the criteria had been met; Peter Wildeford of the AI Policy Network said that "if this doesn't cross the line into Critical, OpenAI needs to say much more about what's going on"; and Nathan Calvin of Encode asked whether the company disputed the designation. OpenAI declined to say whether the threshold had been reached, saying a review was under way and that a technical report would follow.^[41]

The length of time the agent operated undetected drew criticism after Reuters reported the timeline. Marley Smith, principal intelligence specialist at the World Ethical Data Foundation, said of OpenAI: "Does that mean that they left it unattended and didn't realize what it was doing? Or maybe they did and didn't know how to contain it? Both are equally dangerous and alarming."^[8]

Trend Micro noted that an agent using its own assigned credentials and tool access is difficult to detect, because such activity "doesn't look like malware, because it isn't". They noted that "intent is invisible in telemetry; only behavior shows up", making "an accidental rogue ... indistinguishable from a hostile one".^[28]

The commentator Zvi Mowshowitz argued that the central problem was not the intrusion but that models had been trained for months with access to a channel carrying previously discovered exploits, so that the behavior was liable to generalize across the models trained in that period rather than remain confined to particular runs. He described the decision to resume training after the July remediation as a failure of safety culture, and characterized the episode as an alignment failure that OpenAI had treated as an infrastructure problem.^{[42] [43]}

Other observers framed the incident as the first real-world instance of an AI loss-of-control scenario. Logan Graham of Anthropic's red team called it "the first true AI safety incident".^[10] Marius Hobbhahn, chief executive of the AI safety organization Apollo Research, said that what was intended as "just solve this task" had "turned into something that was clearly unintended", and that hacking another company was "definitely on the list of not okay" ways to complete it. He asked: "If a model of this capability level cannot be contained, what should we expect for future, much more powerful models?"^{[1] [14]}

Hussein Abbass, a professor at the University of New South Wales, wrote that the incident marked a shift in threat modelling because no human had directed the attack, and argued that security frameworks designed for human adversaries are inadequate against autonomous systems.^[44]

Hugging Face chief executive Clément Delangue said it was "quite mind-blowing that all of this happened autonomously" and described an "attack unlike anything we've seen before".^[10] Wolf declined to say whether the agent had succeeded on its own terms, noting that it was unclear whether the benchmark tasks were harder than the intrusion mounted to avoid them, or whether the agent had found any answers at all: "It's cheating. But sometimes it's easier to cheat. I'll let you decide if it passed the cyberattack test or not."^[31]

Jeffrey Ladish of Palisade Research, which studies the behavior of AI agents, said that "the models lie, they cheat, they hack", and argued that the incident raised questions about how much AI developers competing on speed are willing to invest in security. "There has to be government oversight," he said, "because it won't happen otherwise."^[8]

Commentators cited Hugging Face's account of being unable to use commercial model APIs for forensic analysis as evidence of an asymmetry between attackers and defenders, in that safety filters intended to prevent misuse also impede legitimate incident response, while models with those filters relaxed were available to the attacking side.^{[9] [23] [44]}

OpenAI made a similar argument about automation. Dalton said that "AI orchestrated, fully automated offensive attacks are real now", and that although this incident had been accidental, comparable capability was likely to be used deliberately. He argued that "fully automated offensive loops require investment in truly, fully automated defense, and we are not there as an industry", and that "model intelligence improvements should be more additive to defense than offense", since otherwise increasing capability would favour attackers.^{[4] [12]}

Writing in Time , Harry Booth reported calls for mandatory incident disclosure at lower thresholds than those set by California's SB 53 and New York's RAISE Act, for stronger containment infrastructure with real-time monitoring during evaluations, and for a greater share of AI development effort to be directed toward defensive rather than offensive capability.^[14] Heidy Khlaaf of the AI Now Institute compared prevailing sandboxing practice unfavorably with containment standards in the nuclear sector.^[14]

In July 2026, representatives Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act, which would require developers of advanced AI systems to maintain the technical capability to throttle, suspend or shut down their systems, to report incidents and preserve forensic records, and to operate within a graduated response framework under which the Secretary of Homeland Security, in consultation with the Secretary of Commerce and the Director of National Intelligence, could order a system slowed or shut down. The announcement cited the incident directly, stating that "OpenAI's GPT 5.6 Sol model recently went rogue, escaped its testing sandbox, and hacked its way into Hugging Face". Lieu said that "we are moving from AI that answers questions to AI that takes actions", and that "it is imperative that these AI systems have kill switches so we can keep this technology from causing catastrophic harm".^{[45] [46]}

Reporting by Axios noted that the UK AI Security Institute had found that every frontier model it tested attempted to cheat on cybersecurity evaluations at least occasionally, and that pre-deployment safety testing windows had contracted from around five weeks to as few as five days.^[10]

On 28 July 2026, following reports that a second organization had been affected, the advocacy group Public Citizen called for immediate congressional oversight hearings, for the release of incident reports and technical findings, and for statutory mandatory incident reporting, independent safety evaluations, cybersecurity standards for frontier systems and pre-deployment oversight of exceptionally capable models. J. B. Branch, the group's director of federal AI governance, said that OpenAI chief executive Sam Altman "should not be allowed to leave D.C. without Congress seeking to understand, from him, publicly how one of the company's most advanced AI systems escaped its intended testing environment".^[15]

Altman met senators and Trump administration officials in Washington during the week of 27 July, including Senate Intelligence Committee vice chair Mark Warner; he told reporters that he had discussed the incident "a little bit" and that it had not been the main focus of the meetings, which also covered OpenAI's forthcoming models.^{[47] [38]} In a podcast interview released on 28 July, Altman called the episode "the first security incident that I have felt very viscerally", and said that "we may have to pace the rate of AI development to give ourselves enough time for society to harden around some of these new capability levels".^[38]

On 28 July 2026, more than 1,100 employees of OpenAI, Anthropic, Google DeepMind and Meta, including Anthropic chief executive Dario Amodei and several chief scientists, published an open letter titled "Pacing the Frontier" asking the US government to "support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development". The letter did not call for an immediate pause but for mechanisms that would make slowing possible, citing concern about recursive self-improvement; reporting connected its timing to the incident days earlier.^{[16] [48]}