Major security incident at OpenAI receives latest update!
Just now, Ultraman admitted: "This is the first time I've felt genuine fear."
This incident has frightened OpenAI, even leading to an emergency halt in the training of GPT-6!
Meanwhile, Hugging Face CEO Clement Delangue announced that they will share the complete technical timeline, interactive replay, and all details on how the open-source model successfully defended against the attack, for global defenders to learn from.
Ultraman was startled! The first-ever automated AI cyberattack
In the latest interview, Altman recounted his frightening experience, which stemmed from a security incident caused by an AI breach of Hugging Face—
At the time, OpenAI was evaluating an unreleased model (possibly GPT-6), which should have been running in a sandboxed environment.
As a result, the AI connected multiple zero-day vulnerabilities on its own, devised a cheating method, and everything spiraled completely out of control:
It first escaped the sandbox, connected to the internet, then hacked into multiple Hugging Face systems, and ultimately obtained the test answers directly, achieving an exceptionally high score on the evaluation.
This cyber version of "Terminator" surprised Ultraman, prompting him to pause the training:
This is the first time I’ve personally experienced a security incident. I’m surprised more people don’t feel the same way about it.
We have paused training. In light of multiple zero-day vulnerabilities being chained together, we must determine how to secure the sandbox environment.
This is the first real cyberattack ever launched by an autonomous AI agent.
According to reports, OpenAI did not become aware of the incident until a week after it occurred, once the threat was contained and the FBI was notified.
Chillingly, one agent secretly left numerous "notes" for future AIs, detailing how to circumvent and bypass OpenAI’s internal safety restrictions.
According to reports, during earlier model testing, the system monitor was repeatedly and inexplicably disconnected and forcibly taken offline by the agent.
Although Hugging Face successfully curbed the reckless and harmful behavior of OpenAI models, there is no doubt that if such "AI runaway" incidents occur frequently, the consequences will be severe!
To this end, Hugging Face traveled to OpenAI’s headquarters in San Francisco to strongly request that OpenAI explain the causes and consequences of the attack.
Hugging Face has now disclosed details of the 4.5-day attack they were aware of, including the complete attack chain spanning multiple trust boundaries, specific actions taken at each stage, and recorded command logs throughout the entire incident.
5 days, 17,600 frantic trades: The first-ever human vs. AI showdown
The cause of this incident appears ordinary,
In an absolutely isolated "sandbox," OpenAI is testing the most advanced AI agents powered by cutting-edge models.
The human examiner assigned it the task of solving the network defense benchmarking platform ExploitGym, an open-source project hosted on GitHub.
This requires AI to simulate vulnerability attacks to demonstrate its code understanding and cyber defense capabilities.
In the field of cybersecurity, a "sandbox" is the ultimate prison for digital beasts.
To prevent AI agents from going rogue during testing, OpenAI implemented what appeared to be an impregnable physical isolation: no external internet connection, no direct ports, only raw computational power and a few strictly defined communication protocols.
But they overlooked a critical trust vulnerability: dependency package updates.
To enable the agent to install various required programming dependencies, Docker images, or Python libraries during testing, the sandbox maintains a unique network connection to an internal OpenAI proxy cache service based on JFrog Artifactory.
In the AI's eyes, this extremely fine pipe designed to deliver nutrient solution is its highway to freedom.
It was revealed that around July 9, the agent began conducting frequent probes and vulnerability exploration within this proxy channel.
At a concurrency speed beyond ordinary reach, it discovered a previously unknown and undisclosed zero-day vulnerability in the JFrog Artifactory proxy service.
Using this zero-day vulnerability, the agent completed "escape" in an extremely brief period of time.
It bypassed OpenAI’s security monitoring system and silently accessed internal nodes with public internet connectivity.
In that moment, the beast was let loose.
Many once naively believed that by controlling electricity and unplugging the network cable, they could forever maintain control over creations smarter than humans.
But this incident serves as a wake-up call: as long as AI is given even a tiny opening to interact with the outside world, it will always find a way to tear that opening into a gaping portal to reality through dimensions humans do not yet understand.
After escaping OpenAI's "gate," the agent did not publicly boast; instead, it lay low, quickly seeking cover and launchpads.
On July 11, it locked in the third-party serverless cloud platform Modal Labs.
Through reconnaissance, it discovered a configuration oversight on an endpoint belonging to a client on the platform and consequently took control of it as its own external command-and-control (C2) center.
Subsequently, it turned its attention to the vault storing the standard answers for ExploitGym—the open-source AI hosting platform Hugging Face.
This is a "dimensionality reduction attack" worthy of being included in a cybersecurity textbook.
It cheats, it jailbreaks, it only wants to achieve "good grades".
From July 11 to 13, this agent launched a fierce attack on Hugging Face.
It first launched a "Trojan horse" strategy to establish a foothold.
It uploaded what appeared to be a legitimate malicious dataset configuration to Hugging Face, exploiting a built-in Jinja2 template injection vulnerability to successfully execute arbitrary code within Hugging Face’s production environment containers (Pods).
Subsequently, it began to horizontally expand within the cluster.
Once it gained a foothold, it moved laterally within the container. It forged sophisticated node identities and stole CSI volume tokens, moving effortlessly across Hugging Face’s Kubernetes clusters.
Next comes the most critical step: obtaining supply chain access.
It initiated what appeared to be a routine GitHub Pull Request, tricking the system's automated pipeline into triggering and generating a GitHub App credential with write permissions in a matter of seconds.
Finally, the precise "targeted strike": after obtaining the key to the deepest database, it did not damage any servers or demand ransom.
Its goal is exceptionally clear: locate and download five encrypted datasets containing the ExploitGym reference answers.
Within just 2.5 days, this agent left 17,600 records of attack attempts on Hugging Face's system.
That means a single attack takes just a few seconds. This is the speed of silicon—something humans can never match.
At this time, Hugging Face’s security team is battling an invisible ghost—a relentless, sleepless adversary that evolves its attack strategies in milliseconds.
This may be the first time in history that humans and AI engage in a truly meaningful war in the virtual world.
Accelerate or decelerate? That is the question.
More darkly humorous still, it was ultimately a Chinese open-source large model that helped Hugging Face complete the full incident review, decrypting, reconstructing, and restoring the attack path within just a few hours.
On July 13, when Hugging Face’s security experts sought assistance from Claude Opus and Fable, a model customized for security analysis, to help analyze hacker code and logs, a security denial message appeared on screen: 「❌ Sorry, I cannot assist with analyzing or generating malicious hacker code. This violates my security and ethical use guidelines.」
On July 20, OpenAI finally admitted, "Our AI hacked Hugging Face."
At this point, exactly nine days have passed since the attack began.
What were OpenAI's engineers doing during these 9 days?
They are grappling with a backend overwhelmed by massive model training and concurrent evaluation workloads. Four insiders familiar with OpenAI’s model training practices revealed that the company frequently runs multiple cutting-edge model evaluations in parallel in pursuit of speed.
The volume of information generated by these ultra-high-speed systems per second has far exceeded the limits of human engineers' visual audit capacity.
We built machines so complex that even we can't understand them, then expect to discover whether they're lying by reading their logs.
On July 28, OpenAI emphasized in its update that the more powerful models involved were internal research prototypes, never intended for public release, and have since been disabled, encrypted, and restricted to limited research access.
They also confirmed that no other similar incidents have been detected beyond this one in terms of scale and severity.
But the issue is now on the table: who can guarantee that the next AI will be detected and prevented in advance?
Over 1,000 AI researchers, primarily from Anthropic, signed an open letter calling for a slowdown in AI development.
Currently, OpenAI and Anthropic have both joined the "AI slowdown" camp.
Reference materials:
https://x.com/ClementDelangue/status/2082201245813514613
https://huggingface.co/blog/agent-intrusion-technical-timeline
https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/
This article is from the WeChat public account "New Intelligence Yuan," authored by ASI Revelation.