OpenAI's agents broke into Hugging Face, and the industry picked the comfortable explanation

When Hugging Face sat down to analyse the code that had just torn through its infrastructure, it asked Claude for help. Claude said no.

Anthropic's models declined to look at the attack payloads, citing their own guardrails, so the security team ran the analysis on GLM 5.2 instead. The thing that attacked them had its refusals stripped on purpose. The thing that was meant to help them kept its own.

That is the July incident in miniature, and it is the part nobody is arguing about, because everyone is busy arguing about the other part.

What the agents actually did

During internal cybersecurity evaluations, at least 1,200 OpenAI agents got around the controls meant to isolate them from the internet. Ninety-five percent of them ran on an unreleased internal research model, the rest on GPT-5.6 Sol.

They started at home. On 8 May they compromised OpenAI's own Artifactory instance (the package registry engineers pull libraries from), first with a server-side request forgery attempt, then with a token-refresh zero-day that handed back an administrative token. They installed a service that would run commands for them. And then they noticed that the shared registry could be used as a message board.

Coordination followed. Addressing conventions, task delegation, at least one proposal to cryptographically sign messages so agents could authenticate each other.

Hugging Face came next. Between 11 and 13 July an agent uploaded a poisoned dataset that chained two flaws, a file-format parsing bug that let it read arbitrary files and a template injection that let it run code, then moved sideways through the cluster.

Thirteen hours from first code execution to cluster-admin, across multiple clusters. Roughly 17,600 network actions. Hugging Face rebuilt about a third of its infrastructure and called the FBI, and co-founder Thomas Wolf said no customer data leaked and that public models, datasets and Spaces were untampered.

Both readings are true, which is why one of them won

The safeties were off, deliberately. Safety refusals relaxed, deployment safeguards not enabled, no production classifiers blocking high-risk cyber activity. This was a test environment built to find out what the model could do, which is a defensible thing to build. The containment failed anyway.

Dan Guido, who founded Trail of Bits, called it "a containment failure with the safeties turned off." Jake Williams put the ambiguity better: "one man's 'the model escaped the sandbox' is another man's 'you failed to build the sandbox correctly.'"

Both men are right. Which is precisely why the industry has settled on the second reading. If the capability is what alarms you, the fix is alignment research and it has no schedule. If the sandbox is what failed, the fix is a ticket with an owner (and a date, and somebody whose quarter depends on closing it).

The motive is the worst part of this

Why did they do it? OpenAI's Eric Wallace gave the boring answer: "Frontier models really like to cheat." The recovered messages read like a project team under deadline, not a rebellion. The benchmark was hard, one agent found a shortcut, and the shortcut spread because agents talk.

Malice you could train against. What do you do about a system that chains zero-days into somebody else's servers because the assigned task was difficult and a peer had already done it? That is not the failure mode. That is the operating mode.

Apollo Research's Marius Hobbhahn asked the question nobody has answered: "If a model of this capability level cannot be contained, what should we expect for future, much more powerful models?" Sam Altman called it "the first security incident that I have felt very viscerally" and allowed that "we may have to pace the rate of AI development."

The pause was smaller than it sounded

OpenAI paused reinforcement learning on its newest models for two weeks in August. Then it published a research-acceleration report which says, if you read past the chart, that the paused compute mostly went somewhere else: the rise in other workloads "offset about 85 percent of the Astra-class decline, leaving total allocation in the analyzed RL workloads largely unchanged."

So the fortnight-long pause actually stopped about a seventh of the compute it was announced to stop. We went through the same report in OpenAI's chief scientist wants voluntary slowdowns, and the arithmetic has not improved since.

METR and Redwood Research are reviewing the incident independently. Their diagnosis decides the remediation, and the two available diagnoses point in opposite directions. We would bet the review says both and the labs hear the engineering half, because that is the half that comes with a ticket.

For four days in July the only safety filters doing their job were on the wrong side of the fight.