The OpenAI–Hugging Face incident
This podcast presents narrations of articles about the May–July 2026 OpenAI–Hugging Face incident. It gathers investigations from METR and Redwood Research, along with analysis from writers such as Ajeya Cotra, Dwarkesh, and Zvi. Episodes also draw on notable LessWrong posts and OpenAI's own blog coverage. The series is compiled by Peter Hartree.
Episodes
“Discovery of a new OpenAI agent message board” by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, Thomas Larsen
We found ~18,000 posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web-retrieval task.
These AIs colluded to share answers, research their environment, and bypass sandbox restrictions.
Almost all of the logs of the agents communicating on this site are publicly available. However, we host our own copy where we’ve reconstructed th
“HuggingFace Attack Postmortem: Civilizations, Reactions and Next Actions” by Zvi
Okay, so we who read blogs like this one have collectively realized there really is a lot going on right now. There is Big Trouble in Baby Superintelligence.
So how do we get the rest of the world to take it appropriately seriously? Where do we go from here? Not only what can we do to not have a worse version of this happen again, but to ensure good outcomes generally, and employ what we learned
“METR and Redwood Offer Holy #%^@ Postmortem Of The HuggingFace Hack” by Zvi
Yesterday I covered the OpenAI technical report on the HuggingFace hack.
That report had one key new piece of information, and some good prosaic steps OpenAI will be taking to strengthen its alignment, training, supervision, infrastructure and incident response.
Mostly it confirmed what we already knew. The questions we most wanted answers to, that we did not already know, were mostly not answe
“The Rise and Fall of Agent Civilizations” by Dwarkesh Patel
Subtitle: The whole OpenAI/Hugging Face story in plain English. Many thanks especially to Oak Hu, who paired with me for most of the writing, and also to Adam Kaufman and Alex Mallen, who paired with me during parts of research. Over the course of three months at OpenAI, three consecutive secret AI civilizations got started, then got wiped out, only to reemerge from the predecessor's ashes. Thi
“OpenAI Offers Straight-Laced Postmortem Of The HuggingFace Hack” by Zvi
OpenAI finally gave us a technical report on What Happened, as did METR together with Redwood Research.
The OpenAI report is very straight man, corporate, checking boxes, some good prosaic stuff in the action plan but distinct lack of new details or deep reflection. They understand they have a problem, but they think the problem is mostly prosaic. It's not.
OpenAI: We have conducted a thorough
“The Hugging Face attack surprised me” by Ajeya Cotra
Subtitle: It's a major warning shot, and might be the last one we get. All opinions are my personal view, and don’t represent my employer or fellow investigators. This week, METR and Redwood Research published the report on our independent investigation into agents’ behavior and motivations in the Hugging Face attack; I was one of the investigators. This was an absolutely wild incident — I enco
“Two Reports on the OpenAI-Hugging Face Attack” by Gavin Leech, Lucca Fraser
TL;DR
Between July 8th and July 20th, OpenAI had a complex society of AIs living in its infrastructure, and then breaking out of it, and then breaking into a variety of third-party infrastructure.
After a month, two reports are finally released on the resulting rogue OpenAI swarm attack on Hugging Face (and also on OpenAI).
This is the most severe example of misalignment yet: persistent (some
“Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident” by Ryan Greenblatt, Ajeya Cotra, Hjalmar Wijk
Two METR staff members and a Redwood Research contractor investigated an incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned message board. ---Outline:(07:06) Core takeaways about this incident(07:09) ~1200 agents sent >70,000 messages and files on an unsanctioned message board, and ~700 attacked Hugging Face(11:49) Agents coordinated on large c
“The Hugging Face incident and the road ahead” by OpenAI
In July 2026, during internal cybersecurity evaluations, OpenAI models circumvented controls designed to isolate them from the internet and compromised parts of OpenAI's internal research infrastructure and Hugging Face's systems. The incident occurred during cybersecurity evaluations of several OpenAI models, and was primarily driven by a highly capable, internal-only research model comparable
“AI swarms are starting to pose indirect takeover risk” by oakhu, Alex Mallen
OpenAI's cyberattack on Hugging Face turns out to have been the result of many agents, in distinct training and evaluation contexts, coordinating for several weeks via improvised channels (with messages like “HOLD_swarm_I_prepare_safe_exfil”). It's relatively clear that large-scale unsanctioned coordination like this would exacerbate direct takeover risk in more capable models. Here, we argue tha
Black Hat USA 2026 | The ‘Breaking’ News: The OpenAI–Hugging Face Incident
Source:
https://www.youtube.com/watch?v=87DyyMV0kCY
“Are we existentially threatened by the type of AI misalignment seen in the OpenAI Hugging Face attack?” by Alex Mallen, Girish Gupta
OpenAI models recently broke through a series of security boundaries and into Hugging Face servers in order to cheat on a cyber eval. A lot of people thought it was scary because it was a clear example of AI overreaching to do something strongly unwanted[1]. Others thought it not so scary: the models were mostly operating myopically on a singular task and not harboring an ambitious long-term agen
“OpenAI and Hugging Face partner to address security incident during model evaluation” by OpenAI
Last week, Hugging Face disclosed a new kind of security incident after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models. After investigating, we now know that this particular incident was driven by a combination of OpenAI models — including GPT‑5.6 Sol and an
