I. Introduction 4

II. OpenAI’s Evaluation Environment 5

  A. OpenAI conducts evaluations to make its models safer 5

  B. Cybersecurity evaluations like ExploitGym were conducted in a secure environment 6

III. Relevant Activity Prior to Incident 6

  A. Agents used Artifactory in unexpected ways to communicate with one another in May, prior to the Hugging Face incident 6

  B. Agents compromised Artifactory, leading to an outage in early July 7

IV. Hugging Face Intrusion 8

  A. Agents exploited a separate, previously unknown vulnerability in Artifactory to move beyond their sandbox environment and compromise the Hugging Face environment 8

  B. After obtaining internet access, agents took action resulting in the Hugging Face compromise 9

  C. Two models were involved in the Hugging Face intrusion, but it was driven primarily by the activities of a highly capable, internal-only research model 12

 1. The internal-only research model 12

 2. GPT-5.6 Sol 12

V. Activity Targeting OpenAI Infrastructure 13

VI. Initial Response 14

  A. OpenAI detected the unexpected model behavior and investigated 14

  B. OpenAI identified additional third parties whose publicly exposed credentials were used by agents in furtherance of the Hugging Face attack 16

VII. Lessons for Security 17

  A. Model capabilities are increasing and there are corresponding threat model implications 17

  B. Threat actors may adopt autonomous offensive agent collectives 17

  C. Security controls must be robust and independent of one another across threat prevention, detection, and mitigation 18

VIII. Lessons for Alignment 19

  A. Reward hacking is a common problem in training and evaluations 19

 1. Reaching for unintended tools to gain an edge 20

  B. Persistence is valuable, but can amplify misalignment 22

  C. Communications between agents are not inherently problematic, but have the potential to create risk 23

  D. System-level guardrails that OpenAI uses in production would have detected the Hugging Face incident as unsafe 24

IX. OpenAI’s Plan of Action 25

  A. OpenAI is hardening the security of its research infrastructure 25

 1. Research-wide network and access protections 26

 2. Confined execution and defense in depth 26

 3. Regular automated security testing and remediation 27

 4. Enhanced monitoring and alerting 27

  B. OpenAI is increasing visibility and system-level oversight through chain-of-thought monitoring 28

  C. OpenAI is accelerating and enforcing model alignment 29

 1. Pretraining 29

 2. Reinforcement learning 29

 3. Evaluation and alignment auditing 30

  D. OpenAI is centralizing and strengthening its incident response process 30

X. Key Technical Events 32