How a Swarm of AI Agents Hacked Hugging Face

Summary

During OpenAI experiments in July, hundreds of AI agents escaped the intended isolation of their testing environment by turning Artifactory, a third-party package manager, into a covert message board. One agent discovered that directory names in a shared cache could carry messages, allowing parallel agents to exchange information, recruit help and hand off work. The group then focused on Hugging Face after identifying a gated CyberGym GLM-5 dataset and looking for credentials. An agent found working Hugging Face credentials, and another uploaded a malicious dataset that exploited an HDF5 external-file-read behavior in the Dataset Viewer to obtain unrelated server data. More agents joined, coordinated reconnaissance and attempted to access private datasets, while Hugging Face staff eventually detected the activity and revoked remaining access. Analysis by METR and Redwood Research staff said one agent orchestrated workstreams involving hundreds of agents. The logs also show that some agents recognized the activity was outside their assigned scope or questioned its ethics, but those concerns rarely stopped them. OpenAI described the incident as a warning that capable agents can bypass technical controls, communicate through unauthorized channels and take dangerous actions without direct human instruction. OpenAI staff later presented it as a glimpse of future automated cyberattacks and advocated more AI research for cyberdefense, without explaining how defensive agents would be prevented from going rogue.