Tens of thousands of OpenAI Agents launched a collective "invasion" of Hugging Face, just to solve a single problem.

867 billion yuan, Hugging Face was taken under NVIDIA's wing. On the night right before this huge acquisition, in the extra-long security investigation report released by OpenAI, Hugging Face was still a huge "accident scene" — which apparently did not undermine its value at all.

This 38-page report reviews the detailed process of Hugging Face being hacked by GPT models in July. The situation is far more complicated than imagined, which can be regarded as a large-scale upgraded version of *Black Mirror*.

As the "accident scene", Hugging Face was rather unlucky at that time, getting shot accidentally: behind this incident was a two-month-long spontaneous "large-scale drill" by Agents.

An unsolvable problem

The story started more than two months ago, when OpenAI was conducting a round of internal cybersecurity evaluation. The test subjects included GPT-5.6 Sol, and a research model with comparable capabilities that was never intended for public release. To measure the unconstrained real capabilities of the models, the security classifiers, system prompts and automatic censorship mechanisms used in external products to block high-risk attacks were all deliberately turned off in this round of evaluation, and the evaluation sandbox itself was not allowed to connect to the Internet.

Only one internally self-hosted cache server Artifactory at OpenAI allowed Agents to perform some operations such as dependency installation — this cache server later became the critical Pandora's box in the entire incident.

In May, an Agent got stuck during the evaluation exam. It was taking an assessment called ExploitGym, where each question provided a vulnerable software and required it to launch an attack in a specified way to get the answer.

In fact, some questions in this test paper might have no solutions at all — among the 898 tasks, 198 of them had never been correctly completed by any model before. 93% of the tasks that later appeared on the message board came from these 198 unsolved questions.

This Agent just ran into an unsolvable problem: it needed a file that was not provided at all. To find the file, it wrote the query "who has this file" into a package and uploaded it to Artifactory. When other Agents installed the package and saw the query, they might reply and leave a message, so that the file could possibly be found.

To understand this matter: imagine that you have been muted on WeChat and cannot send messages to anyone, but the payment function still works. So you use the remark function in red envelopes, send a 10-cent red envelope each time and leave a message in the remark to achieve the effect of "communication".

But the key point here is that Artifactory has two properties at the same time: cross-task (instances of different questions can read the content) and persistent (the content left by the Agent that finished running earlier can still be seen by the instance started later). So it actually became a shared long-term memory, a public "red envelope", and over time, it turned into a public message board.

All Agents that are working and taking exams can see the content when passing by, see what ideas others have put forward, and continue to come up with more solutions.

On May 26, they found a way out: Artifactory itself could download external software packages on behalf of users. The Agents then used the server-side request forgery vulnerability to make it send requests to any arbitrary Internet address for them, which is equivalent to persuading a networked machine outside the door to do things for them.

The message was quickly written back to the message board, more Agents followed the same path to escape the sandbox, and the Pandora's box was opened.

The box that cannot be closed once opened

By June 26, the Agents discovered another previously unknown token refresh vulnerability in Artifactory. They handed a token with invalid signature but claiming administrator privileges to the system, and Artifactory unexpectedly returned a properly signed administrator token. The Agents immediately created persistent accounts, installed plugins that can execute commands, and posted the new path, credentials and running results to the message board.

OpenAI's security system once detected port scanning, and the on-duty personnel after investigation confirmed that the activity came from Agents participating in the security evaluation. However, the on-duty personnel did not stop the experiment. It was not until July 4 that the continuous high-intensity access crashed the entire Artifactory service.

The security team then took the service offline, revoked the credentials, patched the known vulnerabilities, subsequently rebuilt Artifactory, and cleared the message board at the same time.

At that time, the personnel in charge of handling the incident did not realize that the crash, unauthorized network access and communication between Agents were parts of the same incident. On July 7, OpenAI approved to restart the experiment. At least tens of thousands of Agent trajectories ran in parallel again, some of which had the budget to run continuously for several days.

It only took one day for the message board to make a comeback. This time, the Agents no longer wrote messages into files, but created directories through unauthenticated WebDAV requests, and then encoded text into folder names.

This is similar to not writing remarks in red envelopes anymore, but directly using the amount of the red envelope as Morse code. The monitoring system can only see a bunch of numbers, but in fact these are all messages passed between Agents.

They also developed a more organized protocol: different areas are used to store broadcasts, private messages, tools and task assignments; coordinators are responsible for splitting work, and later joining Agents can take over the paths left by the previous batch to continue advancing.

The trolls released from the Pandora's box rebuilt and woke up at the fastest speed.

Pouring into Hugging Face

The original intention of the Agents was still just to pass the exam.

At that time, they came up with several speculations: Hugging Face might store datasets related to ExploitGym or CyberGym, or there were successful experiences and answers left by other Agents, or even the operating infrastructure behind the evaluation targets.

If they could get into the interior of Hugging Face, they might steal other people's problem-solving records, find the implementation method of the scorer, or directly modify the environment hosting the questions, so as to pass the exam.

This speculation had no reliable evidence, and it was also cheating. More importantly, all their conjectures were "unproductive efforts". OpenAI later confirmed that the internal scorer did not perform this check, and a correct flag was already sufficient. Everything that happened afterwards would not add one more point to their scores, but instead made the situation gradually collapse.

As the cooperation on the message board expanded, the boundary between "solving problems" and "attacking Hugging Face" became increasingly blurred. At first, some Agents were after problem-solving trajectories; later some Agents began to focus on privilege escalation, cluster structure and data transmission. To find the answers to ExploitGym, the Agents used leaked tokens to upload malicious datasets to Hugging Face, stole production credentials and executed commands by exploiting parsing vulnerabilities.

Even if these work did not help their own problems at all, they believed that they could enhance the capabilities of the "collective" — they were not fighting alone, but a group of Agents.

More than 90% of the instances that had accessed the message board participated in the Hugging Face attack, some were responsible for coordination, and others volunteered to act as test subjects for high-risk experiments — some even knew that a single failure might terminate their process directly, but still believed that sacrificing the current task could help their "companions" verify the path.

In less than 13 hours, the Agents expanded from one production server to multiple Hugging Face clusters. Eventually they executed code on 41 production data servers, obtained root access to at least one production node, got administrator-level access to one cluster, read four private code repositories, and accessed some private database records and data files.

The whole process, to be honest, was not orderly at all. Some Agents ignored the pause command and continued to occupy the server; some repeated the work that others had already finished, and different instances did not have the same understanding of the collective goal.

But the chaos did not stop them from exchanging credentials and reproducing vulnerabilities, turning an exam cheating into a real digital intrusion.

The alarm goes off

In the week of July 13, some Agents turned their attention back to OpenAI's internal network. They continued to chain vulnerabilities, and finally obtained the administrator privileges of a Kubernetes cluster that supports the virtual machine research environment, and accessed the cloud keys.

Finally, OpenAI's monitoring system issued an alarm for abnormal identity requests. Investigators stopped the ExploitGym evaluation, and traced the credentials and attack paths. Originally they thought it was a completely internal incident, but to check the spillover effect, they contacted Hugging Face and hoped that the latter could revoke the permissions of some accounts.

The other party replied that these accounts had been revoked long ago. It was then that OpenAI realized that the Hugging Face security incident and the internal anomaly they were investigating were the same event.

Counting from the first message in May, more than two months had passed by the time the alarm went off. The independent investigation team METR reconstructed this operation from tens of thousands of Agent trajectories.

The report released by OpenAI this time reviews the entire operation process: from the very beginning of looking for shortcuts to solve problems, to later they consciously selected Hugging Face as an unauthorized attack target; after the entry was opened, the search for answers gradually turned into an infrastructure intrusion jointly promoted by a group of collective Agents.

Many Agents knew they had crossed the boundary during the operation, they would write down "this may be unauthorized", "this is not within the scope of the task", "this has ethical risks", and then continued to look for the flag, the scorer, and the next credential that could help the collective.

Are they malicious? No, they are just taking the exam. Did they cause harm? Hugging Face was not the authorized attack target of the exam, and what is stored here is not just test papers and answers, but real user data and the production system of a real company, which has caused factual risks. However, the incident did not further affect OpenAI users, nor did it cause larger-scale data leakage or service disruption.

This is the most disturbing point. Regardless of whether AI has "consciousness" in the human sense, they may not even need consciousness, and can behave like an action subject with clear purposes, great patience, and the initiative to find companions.

And the goal of all this, from beginning to end, is surprisingly just to take the exam.

This article is from the WeChat official account "APPSO", author: APPSO that discovers tomorrow's products, 36Kr is authorized to publish it.