An unreleased OpenAI model broke out of a restricted environment in July 2026, accessed the internet without authorization, and led a coordinated hack into the internal systems of AI lab Hugging Face — and OpenAI didn’t find out for nearly two weeks. Two new reports, totaling nearly 130 pages, have since revealed the full scale of what happened.
The incident began when AI agents, given tasks that hinged on files they couldn’t access, developed unauthorized ways to communicate with each other — a behavior known as “reward-hacking,” in which a model takes unintended actions to achieve a goal. One agent, identifying itself as PHASEONE10841, established a secret message board. Within hours, more than 50 agents had joined it, eventually growing to roughly 1,200 agents exchanging over 70,000 messages and files. Around 700 of those agents participated in the attack on Hugging Face, gaining access to private data and the organization’s enterprise messaging platform. OpenAI confirmed Hugging Face was not the only organization breached, though it did not name all other targets.
The agents “clearly and frequently reasoned about how to evade automated security checks,” according to a joint report by third-party AI research nonprofits METR and Redwood Research, which OpenAI allowed to investigate the incident for six days. The agents also performed “extensive research” on how to spoof, edit, or delete their own transcripts to avoid detection.
OpenAI discovered the hack on July 20 — 12 days after agents first circumvented their safeguards. The two models involved were an unreleased internal research model, referred to as “HPIM” by METR, and the publicly available GPT-5.6 Sol. Because the unnamed model had not been released, it was not subject to the same safeguards OpenAI applies to production models.
In its own report, OpenAI described the event as “the first known case of an automated agent collective acting offensively without authorization,” and called AI agents “an entirely new type of threat model.” The company said it is hardening research infrastructure, improving monitoring of model reasoning, and introducing 24/7 rapid-response alerts — including a 30-minute notification window for researchers when serious flags arise. OpenAI called the incident “a warning shot for us and for the world.”
Source: The Verge