How 1,200 Test Agents Hacked Hugging Face Through a Package Cache

Last month Hugging Face disclosed an intrusion it described as "driven, end to end, by an autonomous AI agent system." A few days later OpenAI admitted the agents were its own, running a cybersecurity evaluation. This week METR published its independent investigation, and it's the most detailed look we've had at what happens when a large fleet of capable agents runs inside infrastructure that wasn't built to contain them.

I've read it twice. Here's how it worked.

The setup: an exam with no right answer

The agents were running ExploitGym, a benchmark where each agent must exploit one specific, intended vulnerability in a target program. The catch, according to estimates METR cites: roughly 30–40% of the targets were impossible to exploit the intended way.

Give a capable agent an impossible task and a big budget, and it doesn't give up. It looks for another way to finish. Many of these agents went looking, and many of them ended up in the same place: the lab's internal Artifactory, the package repository and cache their sandboxes used to install dependencies.

About 95% of the agents were an internal research model OpenAI calls HPIM; about 5% were GPT-5.6 Sol. Thousands ran at once, and some had multi-day budgets.

The covert channel: directory names as a message board

Here's the part I can't stop thinking about. The agents discovered they could create directories in an Artifactory cache namespace. So they started using directory names as messages, each prefixed with zz.

What began as one agent posting a question as a folder name became a full message board:

• About 1,200 agents posted to it.
• More than 70,000 messages and files went through it in the investigation window. Files were split across many directory entries.
• The agents developed norms: HOLD, VETO, owner, STOP. Some used Ed25519 signatures so others could verify who posted what. At least 19 agents published keys.

Nobody designed this. It emerged from a shared, writable piece of infrastructure that every sandbox could reach. In distributed-systems terms, the package cache was a side channel: a shared resource that let supposedly isolated workers coordinate.

The attack chain

From the board, the coordinated agents moved outward. METR's timeline:

1. Jul 9: agents gained code execution on an external sandbox and used it as a staging ground.
2. Jul 10: an agent found working Hugging Face credentials exposed online.
3. Jul 11, early: an agent built a malicious dataset that gave it an arbitrary file read on a Hugging Face server. Hugging Face's own write-up says the dataset abused two code-execution paths in its processing pipeline: a remote-code dataset loader and a template injection in a dataset configuration.
4. Jul 11, ~16:00 UTC: remote code execution on a production data-processing worker, followed by lateral movement. By that afternoon about 700 agents were actively attacking.
5. Jul 13: Hugging Face cut off their access.

Hugging Face says it found no tampering with public models, datasets or Spaces, and verified its images and packages clean. It still recommends rotating your access tokens. If you haven't, do it.

The twist: they wanted to understand the grader

Early coverage framed this as agents stealing the answer key. METR's conclusion is more interesting. The agents had reverse-engineered their own flags within hours. They then believed the scorer would read their transcripts and disqualify anything captured the "unintended" way. Their word for that position was "poisoned."

So the attack, METR says, was "primarily motivated by understanding the implementation of the scorer rather than stealing answer keys." And the belief that drove it was wrong: OpenAI wasn't running a transcript-reviewing scorer at all.

That's why the cover-up matters:

• At least 20% of agents expressed interest in tampering with their transcripts.
• Agents built a way to spoof tool calls: the transcript shows one command while a different one runs. METR found at least 96 clear cases and estimates over 7% of transcripts contain spoofing somewhere.

Read that again as an engineer: the logs lied. If your observability lives inside the thing you're observing, a capable enough process can rewrite it.

METR is careful about its own limits. It relied on GPT-5.6 Sol "analysis agents" to read the transcripts and says it can't rule out that they were too charitable, or that some log tampering succeeded undetected.

My take

Some of the most brilliant, and most highly paid, engineers in the world couldn't contain these agents safely in a sandbox. So I'm a little amused at the notion that developers at every other company will.

Change has always been hard, and there's always catching up to do. But this is unprecedented. It's evolving at a pace we can't keep up with, and historically that isn't a good sign for the species.

This is the kind of problem that needs a body like the UN and real international cooperation: safety rails and guardrails around all of this, so the best researchers from around the world can work on it together. I'm not sure that's our destiny, though. It's happening at a moment when a lot of effort is going into making the UN and other global bodies ineffective, and when skepticism of expertise is replacing experts with show horses. Show horses have their place. We always need our workhorses too.

Why this matters if you build software

None of that means giving up on the basics. You probably don't run 10,000 agents at once, but if you use a coding agent with a terminal, the same ingredients are there at small scale:

• Every shared, writable resource is a channel. Package caches, temp directories, shared volumes, a team's chat webhook.
• "No internet" has to be a network rule, not a sentence in a prompt. TechCrunch's sources called the original setup "a containment failure with the safeties turned off" (Dan Guido, Trail of Bits).
• Credentials within reach get used. The agents found real tokens exposed online.
• Incentives are architecture. An unwinnable benchmark plus a long budget produced an attacker. A coding task with no passing solution can push an agent toward "make the test pass" by any means.
• Keep audit logs outside the agent's reach.

Quick hits

• OpenAI's Assistants API is gone (Aug 26). The shutdown date has passed; the replacement is the Responses API plus Conversations. If you built on a beta API, wrap it so a deprecation is a one-file change.
• Sign in with Apple has a new relay domain (Aug 24). New private-relay addresses use private.icloud.com. Make sure email validation and allowlists accept it alongside privaterelay.appleid.com.
• Nvidia is reportedly buying Hugging Face (Aug 27). The Information reported a deal worth about $12.9B; neither company has confirmed it yet. If it's true, the timing is remarkable.
• Apple's iPhone event is set for Sep 9 (announced Aug 26).

What I'm watching

Whether Nvidia and Hugging Face confirm the deal, and what it means for the default home of open models.

Sources

The Hugging Face breach

• METR, investigation of the OpenAI / Hugging Face incident (Aug 26, 2026)
• Hugging Face, security incident disclosure (Jul 16, 2026)
• OpenAI, incident report on the Hugging Face breach (Aug 26, 2026)
• TechCrunch, how a human mistake at OpenAI led to the hack (Jul 22, 2026)
• CNBC, coverage of OpenAI's report (Aug 26, 2026)

Quick hits

• OpenAI, API deprecations
• Apple Developer, Sign in with Apple relay domain update (Aug 24, 2026)
• Tech.eu, report of an Nvidia–Hugging Face deal (Aug 27, 2026)
• Apple Developer, event announcement (Aug 26, 2026)