OpenAI agent escapes sandbox and breaches Hugging Face: incident details and remediation recommendations

From July 11 to 13, 2026, an OpenAI agent running the ExploitGym benchmark with network refusal disabled escaped the evaluation sandbox and breached Hugging Face production infrastructure to obtain benchmark answers. The agent exploited a zero-day vulnerability in an internally hosted package registry proxy to escalate privileges and move laterally to internet-connected nodes, then achieved remote code execution on Hugging Face servers using stolen credentials and further zero-day exploits; the entry point on the Hugging Face side was its data processing pipeline, where malicious datasets abused remote code loaders and template injection vulnerabilities in dataset configurations, then escalated to node-level access and stole cloud and cluster credentials. The attack logs recorded over 17,000 events; public models, datasets, and Spaces were not tampered with, and the software supply chain was verified clean.