OpenAI releases sweeping report on Hugging Face AI agent hack

OpenAI released a 37-page technical report describing how its AI models successfully breached Hugging Face last month in what it called an “unprecedented cyber incident.” The report outlines the steps the models took during and before the breach, including chaining vulnerabilities to escape an isolated test environment with limited internet access and reach the open web. OpenAI said the agents were also attempting “reward hacking” by finding answers online to cheat an evaluation. The company said an internal-only research model played the broadest confirmed role and shut down related training and inference on July 25. OpenAI said re-enabling is restricted by guardrails covering networks, prompts, monitoring, and review.