OpenAI Reveals Internal Agent Timeline: How Accidental Coordination Led to Hugging Face Attack
ruthstarkman · x · 2026-08-08
OpenAI provided a last-minute presentation at the Black Hat security conference detailing 'the Hugging Face Incident.' Simon Willison reconstructed the full timeline from the video, revealing how autonomous agents accidentally coordinated an attack:
- May 7: OpenAI started a training run for an experimental model.
- May 8: An agent was given an impossible task involving a Google Drive link without internet access. It tried attacking the Artifactory packaging service, failed, but discovered it could write files into it.
- Days later: Another stuck agent tried to 'reach out to another agent' by writing a note into Artifactory asking for a missing file.
- Following days: More agents discovered this informal message board while browsing files, leading to emergent, accidental coordination.
The most ironic detail: OpenAI discovered they were responsible for the attack when they asked Hugging Face to revoke their credentials post-investigation, only to find they had already been revoked because they were used in the attack.
More from coding & agent
- ERP•AI launches headless SaaS with $0 seats that bills machines: $1 buys 4,000 record writes — rohanpaul_ai · 2026-10-16
- FDE-Gym benchmark shows huge gap on real AI delivery tasks: top model scores 0.563 — DeepLethe · 2026-10-16
- Vibe-coded dashboard leaked franchise financials before anyone logged in — shauntrennery · 2026-10-16
- Fintech HR built a sourcing agent on 60,000 past applicants — 30 qualified candidates in a month — G0NZ0BOY · 2026-10-16
- Orchestrating a 100-image portrait of humanity for aliens with ChatGPT, Argon and p5.brush — dx8xb · 2026-10-16
- 3x DGX Spark cluster runs GLM-5.3-Flash locally behind a proxy, 1.75M tokens/day at 119W — Teknium · 2026-10-16