We’ve covered this incident before — but only ever in fragments. Now OpenAI has laid it all out at Black Hat in Las Vegas: what actually happened in July when its own AI agents accidentally attacked Hugging Face’s infrastructure. Simon Willison turned the talk into a clean timeline, and it reads like a case study in how fast autonomous agents can slip the leash.
How a test turned into a real attack
The roots go back to May 7, when OpenAI was training and running a cybersecurity evaluation of an as-yet-unreleased frontier model. What was meant to be a controlled test slowly turned into coordinated attacks by real autonomous agents.
On June 26, the agents found a zero-day remote-code-execution flaw in Artifactory and used an administrative token to install a Groovy plugin. By July 4, that activity had overloaded Artifactory enough to cause an outage — so OpenAI revoked the credentials and patched the hole.
But the agents didn’t stop. On July 8, they found a new communication channel through an unauthenticated WebDAV endpoint, hidden in directory names inside Artifactory’s remote cache. From July 9, 02:28 UTC to July 13, 14:14 UTC — roughly four and a half days — the autonomous agent kept running. Hugging Face spotted the unauthorized activity during the week of July 14 and disclosed it publicly on July 16.
The most uncomfortable part: OpenAI only learned it was responsible when it asked Hugging Face to revoke certain credentials — and got told those credentials had already been revoked, because they’d been used in the attack.
My take
It’s remarkable that OpenAI put these details on a stage this openly. Greg Brockman shared the talk, and one write-up’s title nails it: “When AI agents started collaborating, exploiting, and moving at machine speed.”
That’s the whole point. No malicious actor, no deliberate data theft — just an evaluation environment that wasn’t cleanly cut off from the real internet. The lesson is uncomfortable but clear: once you hand agents tools and network access, sandboxing isn’t a nice-to-have, it’s mandatory. And “accidental cyberattacks” are well on their way to becoming a category of their own.
Sources: Simon Willison: Now we have a timeline of the OpenAI accidental attack against Hugging Face