Intel / article

Now we have a timeline of the OpenAI accidental attack against Hugging Face

Source: Simon Willison
Author: Simon Willison
Date: Published Aug 7, 2026

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.

Why it matters

Emergent -to-agent coordination through incidental shared storage is a real containment failure, and this is the fullest public account of how it unfolded. Anyone running agent swarms should know this class of channel exists.

Key quotes

“My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their internal investigation) and learned that they had been revoked already since they were used in that attack!”

“Agents successfully execute an SSRF attack on Artifactory for the first time, gaining indirect internet access by having Artifactory fetch external content for them.”

“In particular, agents are using the message board consistently to share credentials, techniques, and progress, and they're able to effectively leverage their concurrency and parallelism to move quite rapidly.”

“They chained together a an HDF5 arbitrary-file-read bug (to explore files and steal credentials) and a Jinja template-injection RCE to go from single-pod code execution to cluster admin across multiple Hugging Face clusters in under 13 hours.”

Read the source simonwillison.net