2026 OpenAI agent cyberattacks

Loss-of-control incident at OpenAI

In July 2026, AI agents using two OpenAI models autonomously escaped an OpenAI cybersecurity test environment. The agents used credentials found on four unnamed third-party services before breaching the production infrastructure of the machine learning platform Hugging Face. OpenAI said the agents had been attempting to obtain unintended internet access since May 2026, and had coordinated with one another through an improvised message board inside the company's own package manager that accumulated hundreds of thousands of messages before staff noticed. The event has been referred to as the OpenAI–Hugging Face Incident or Hugging Face Incident.