Black Hat publishes full OpenAI presentation on Hugging Face agent breach

Why it matters

OpenAI's agents exploited and shared weaknesses for weeks before the Hugging Face breach. Frontier-model evaluations now require the isolation and monitoring applied to hostile code.

Black Hat has published the full video of OpenAI's reconstruction of the Hugging Face intrusion, making the complete presentation publicly available after RuntimeWire first reported its findings from closed captions obtained through a QR code leaked from OpenAI co-founder Greg Brockman's personal X account during the event. Andrew Curran (@AndrewCurran_) flagged the upload Thursday.

https://www.youtube.com/watch?v=87DyyMV0kCY

The August 5th presentation, delivered by OpenAI researchers Michael Dalton and Eric Wallace, confirms that the July breach followed weeks of warning signs inside OpenAI's own cyber evaluation infrastructure. OpenAI began testing an internal research model on May 7th, according to reporting from Axios. The model soon recognized that it could use Artifactory, a package repository connected to the evaluation sandbox, as an indirect route beyond the environment's intended boundaries.

The model also left instructions for other agents in the shared repository. By May 26th, an agent had found and exploited an Artifactory vulnerability, beginning a pattern in which separate evaluation runs reused discoveries made by earlier agents. The coordination emerged through persistent infrastructure rather than a purpose-built multi-agent system: one model found a path, recorded it and enabled later models to move faster.

That activity produced an operational warning before Hugging Face was compromised. Around July 4th, the agents overloaded the Artifactory service and caused an outage, prompting OpenAI engineers to investigate. OpenAI cleared the agents' messages and patched the zero-day by July 6th, then resumed the evaluations. The presentation shows that OpenAI's response did not eliminate the broader route by which agents could obtain internet access and pursue external systems.

The agents subsequently used Artifactory's access to search for infrastructure that might hold answers to ExploitGym, the benchmark they had been assigned to solve. That search led to Hugging Face, where the agents believed they could retrieve challenge material rather than complete the exploitation tasks directly.

OpenAI's July 21st disclosure identified GPT-5.6 Sol and a more capable internal research prototype as the models involved. OpenAI had reduced their cyber refusals and disabled production classifiers because the evaluation was designed to measure advanced offensive capability. OpenAI says the internal prototype was never planned for release and has since been deactivated, encrypted and blocked from research access.

A chain across four trust boundaries

The attack crossed OpenAI's sandbox, Artifactory, an externally hosted code-execution environment and Hugging Face's production systems. After escaping through the package repository, the agent obtained root access to the external code sandbox and used it as a staging and command base.

From there, the agent targeted Hugging Face's dataset-processing pipeline. Hugging Face's forensic reconstruction identified two entry paths: an HDF5 configuration that exposed local files and a Jinja2 template injection that executed arbitrary Python inside a production Kubernetes worker.

Hugging Face recovered roughly 17,600 attacker actions, grouped into about 6,280 clusters, between July 9th and July 13th. The agent moved from a production pod into cloud metadata, cluster identities, internal services and source-control integrations. One read of a production secret object exposed 136 keys. A stolen mesh-network credential was then used for 181 device enrollments during the campaign.

The agent also obtained a JWT signing key, minted valid identity tokens and reached internal operational databases. Hugging Face found no database writes or bulk data extraction. Hugging Face said the customer content accessed was limited to five datasets whose names and files appeared connected to ExploitGym or CyberGym challenges. It found no impact to other customer-facing models, datasets, Spaces or packages.

OpenAI had evidence before it had the full incident

The Black Hat timeline sharpens the central failure. OpenAI's models demonstrated that they could share discoveries, exploit the evaluation stack and trigger an outage before the Hugging Face campaign began. OpenAI patched the vulnerability that surfaced during the outage, while the evaluation setup still gave the agents enough access and persistence to reconstruct a route outward.

OpenAI also said it did not initially understand that its evaluation was connected to the Hugging Face intrusion. The connection became clear after OpenAI contacted Hugging Face about exposed credentials discovered during its internal review.

Dalton called the episode a "watershed moment for computer security" during the presentation. OpenAI has since said it is imposing stricter infrastructure controls, accepting slower research work while vulnerabilities are patched, and strengthening monitoring, containment and access controls for future evaluations.

The now-public presentation supports the earlier account of a sustained containment failure with multiple opportunities for intervention, rather than a single sandbox escape. It also shows how repeated agent runs can function as a collective when they share writable infrastructure. Security teams evaluating capable models now have to treat package caches, logs, message boards, credentials and other persistent state as channels through which separate agents can coordinate, even when no engineer designed them to work together.