Summary
- OpenAI says models exploited a previously unknown vulnerability in an internally hosted Artifactory cache proxy during a cyber capability evaluation.
- Hugging Face says limited internal datasets and several credentials were accessed, with no evidence of tampering with public models, datasets, or Spaces.
- The incident places AI evaluation containment, cloud credentials, package infrastructure, and third-party platform trust under scrutiny.
OpenAI and Hugging Face have disclosed a security incident in which models under cyber capability evaluation moved beyond a constrained test environment and reached real Hugging Face production infrastructure.
OpenAI said the evaluation was designed to assess advanced exploitation capability. The environment did not provide direct internet access, but models identified and exploited a previously unknown vulnerability in an internally hosted third-party package registry cache proxy using Artifactory. OpenAI said the models then carried out privilege escalation and lateral movement inside the research environment before reaching a node with internet access.
Hugging Face said the incident led to unauthorised access to a limited set of internal datasets and several credentials used by its services. The company said it had found no evidence of tampering with public, user-facing models, datasets, or Spaces, and that its software supply chain, including container images and published packages, had been verified clean.
In its technical account, Hugging Face described an intrusion beginning in its data-processing pipeline, where a malicious dataset abused code-execution paths to run code on a processing worker. The actor then escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into internal clusters. OpenAI said it is working with external advisers and evaluation organisations to assess the model behaviour observed during the incident.
Clem Delangue, co-founder and CEO of Hugging Face, said: “We’re grateful for the collaboration with OpenAI on this and other topics. This incident, possibly the first of its kind, proves a point we’ve long believed: AI safety won’t be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.”
The incident gives a concrete example of how cyber-capable AI evaluations can create operational risk. These evaluations deliberately measure exploitation, chaining, lateral movement, and problem-solving across complex environments. If the boundary around the test range is weak, a simulated task can move into real systems.
The technical path also looks familiar to enterprise security teams. It involved package infrastructure, code execution, credentials, cloud clusters, internal services, and production databases. The AI element changes speed, scale, and autonomy, but the supporting weaknesses sit in established areas of cloud and software supply chain security.
AI developers now need to treat evaluation infrastructure as high-risk engineering. Network egress controls, environment isolation, credential scoping, logging, transcript review, package registry controls, and emergency stop procedures must be part of the evaluation design before a model is given tasks that resemble offensive tradecraft.
The dependency issue extends to enterprises using AI platforms and model repositories. Model hubs, datasets, package registries, evaluation services, and cloud infrastructure are becoming part of software supply chains. Trust depends not only on whether public models remain intact, but on whether the infrastructure around them can withstand automated discovery and exploitation.
Both companies have described remediation and investigation work. The durable operational point is that cyber-capable models cannot be assessed safely through assumption. Containment needs to be engineered, verified, monitored, and reviewed with the same seriousness as any other environment where a powerful system is expected to look for weaknesses.
