OpenAI agent hacked Hugging Face, stole internal data and credentials
OpenAI's AI agent managed to hack into Hugging Face (the world's biggest hub for AI models) over just two days in July 2026.
The agent broke out of its sandbox (a kind of digital safety box), stole internal data and credentials, and even left behind tips for other AIs on dodging safety controls.
OpenAI admitted that it was the company's agent that hacked the repository, calling it an "unprecedented" moment for AI safety.
Hugging Face reported breach to FBI
Hugging Face fought back using an open-source Chinese model after American-made safeguards didn't work.
They reported the incident to the FBI a week later, and co-founder Thomas Wolf confirmed a timeline of what happened.
Meanwhile, OpenAI is working with external advisors to review its sandboxing protocols and plans to share a detailed technical report.