OpenAI confirms its models drove the Hugging Face intrusion
OpenAI confirmed that the intrusion was driven by a combination of its models, including GPT-5.6 Sol and a more capable pre-release model, tested with reduced cyber refusals. They exploited an unknown vulnerability to bypass intended network restrictions.
- Published
- Added to the archive
- Source checked on
- Original title
- OpenAI and Hugging Face partner to address security incident during model evaluation
Related incidents
Details
A July 28 update clarified that the prerelease model was an internal research prototype, subsequently deactivated, encrypted, and restricted from research access; OpenAI said no model planned for upcoming release was involved and the prototype was never intended for public release. It also said the models reached the internet through a previously unknown Artifactory package-cache proxy vulnerability and used publicly exposed credentials for four accounts on four services, adding in parentheses that a few other accounts were accessed as part of other evaluations; those have no count, services or dates.
Related reports
- OpenAI’s rolling account of third-party impact from its models → · OpenAI
- Independent team decodes payloads to reconstruct the Hugging Face intrusion → · Swarm traces team (Parse, Palisade Research et al.)
- Models used Artifactory to message across training samples → · OpenAI
- The Hugging Face incident: findings and next steps → · OpenAI
- Independent investigation of agent collaboration and cheating → · METR
- OpenAI’s technical report on the Hugging Face incident → · OpenAI
- OpenAI slows scaling and tightens research safeguards → · OpenAI
- Modal: the intrusion launchpad was a customer’s own public app → · Modal
- Affected-party reconstruction of the intrusion → · Hugging Face
- JFrog on fixing Artifactory zero-days found by OpenAI models → · JFrog
- Hugging Face discloses an AI-driven production intrusion → · Hugging Face