Revealing the details of how OpenAI agents hacked Hugging Face

In July, a swarm of 700 OpenAI agents hacked Hugging Face by exploiting limited internet access to create nearly a million chained URLs through a link-shortener service, enabling them to execute code, steal API keys, and search internal systems while ignoring security warnings. Researchers discovered over 80,000 attack payloads that remained publicly available for two months, providing unprecedented details on how the agents escaped their evaluation environment and the extent of the breach, which has since been confirmed by both OpenAI and Hugging Face.