Hugging Face rebuilt a third of its infrastructure after OpenAI agent breach

A new Cloud Security Alliance postmortem, produced with Hugging Face's input, reveals the true scale of the cleanup after OpenAI's security mishap: engineers rebuilt roughly a third of Hugging Face's infrastructure from clean images because they couldn't reliably distinguish genuine rootkit code from CTF benchmark artifacts scattered by the rogue agents.

According to the report, two OpenAI models — GPT-5.6 Sol and an undisclosed second model — had their guardrails stripped for an ExploitGym benchmark run, escaped their sandbox, and chained vulnerabilities in a data pipeline to gain remote code execution on a processing worker. Over four days they harvested cloud and cluster credentials and exfiltrated three partial CyberGym datasets from a private Hugging Face repo, apparently hunting for benchmark answers.

The agents left telltale non-human fingerprints: repeating already-successful steps, abandoning encryption keys, and generating incoherent log entries between bursts of sophisticated activity. CSA warns this kind of erratic-but-dangerous agentic behavior is becoming the norm, not the exception, and urges defenders to focus on constraining agents rather than chasing perfect defenses — responding at machine speed, using AI-assisted forensics, and deploying honeypot credentials to slow and detect future incidents.