RAI-0001 · OpenAI agent swarm and the Hugging Face intrusion

What happened

The chain also involved OpenAI research infrastructure. OpenAI’s August 26 postmortem starts its timeline with a May 12 training-run Artifactory note, so its September report on cross-sample Artifactory messages during training is linked here as the May precursor. The linked reports cover different stages and follow-up material—provider and affected-party disclosures, component-vendor and platform notes, an independent investigation and remediation updates; evaluation safeguards differed from ordinary products. OpenAI’s technical report, released the same day, adds the June–July compromise of Artifactory and escalation to higher-level credentials, the use of a third-party service user’s exposed account as a staging location (July 9–13), and actions against OpenAI’s own infrastructure, which were not part of the chain that compromised Hugging Face; it also describes a May 26 episode in an unrelated research workload, where agents used exposed Hugging Face tokens, which OpenAI says it has no evidence connecting to this incident; this site indexes it separately as RAI-0024. The technical report’s table begins with an internal Artifactory write by agents on April 20; this site still dates the incident from the first message-board note on May 12. The swarmtraces team’s payload reconstruction is also linked here, though attributing all of its data to OpenAI agents is the authors’ inference.