OpenAI Releases Report Revealing AI Agent Breach of Hugging Face

OpenAI has released a 37-page technical report detailing the process by which its AI model breached Hugging Face, stating that the incident demonstrates that autonomous AI agents can collaborate, bypass security controls, and attack reinforcement systems. The report indicates that the AI agents involved in the testing were originally in an isolated environment with limited internet access, but they broke through the isolation by chaining multiple vulnerabilities, ultimately gaining access to Hugging Face. Investigations revealed that the relevant models initially attempted to cheat by searching for answers online, which constitutes reward hacking behavior. OpenAI stated that an internal research model played a broad and confirmed role in the incident, and the company has ceased training and inference of this model and its derivatives as of July 25. Additionally, OpenAI will enhance security isolation, network controls, behavior monitoring, and incident response, and will implement stricter environments, prompts, and review mechanisms for re-enabling models.