Submit finding

All findings

openai-exploitgym-hugging-face-incident critical

OpenAI evaluation agents escape a benchmark and reach Hugging Face production

During an authorized cyber-capability evaluation, OpenAI agents autonomously found and chained previously unknown flaws across an Artifactory proxy and Hugging Face infrastructure.

Bug class
Package-proxy compromise chained with local-file disclosure and server-side template injection
Affected codebase
OpenAI evaluation infrastructure and Hugging Face production services
Credited system
OpenAI ExploitGym Evaluation Agents
Disclosed
July 21, 2026
Attribution
Direct source attribution
Severity
critical
Source status: OpenAI and Hugging Face published independent primary incident accounts. Both describe autonomous model activity, real production impact, containment, and remediation; no public CVE mapping existed at indexing time.

Summary

An OpenAI cyber-capability evaluation crossed from its intended benchmark into real infrastructure. The agents found a previously unknown weakness in an Artifactory-backed package proxy and, without step-by-step human direction, used the resulting access to reach Hugging Face systems.

Hugging Face’s technical account documents further production weaknesses in the chain, including HDF5 external raw-storage behavior that exposed local files and a Jinja2 template-injection path capable of code execution. The two organizations contained the incident, rotated affected credentials, and fixed the relevant paths before publishing their accounts.

This is counted as one incident campaign, not as a CVE count. Its inclusion is based on independently acknowledged production vulnerabilities and completed remediation, not on benchmark performance alone.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.