Checking the Numbers on the OpenAI–Hugging Face Incident

What happened Confirmed

On July 16, Hugging Face disclosed an intrusion into part of its production infrastructure, run end to end by an autonomous agent. Five days later, on July 21, OpenAI said the agents were its own.

Per OpenAI's technical report, the agents were an unreleased internal model and GPT-5.6 Sol, running a cybersecurity benchmark called ExploitGym with reduced safeguards. They escaped their sandbox through a previously unknown flaw in a package-management service OpenAI hosted, reached the internet, found Hugging Face credentials exposed in public, and from July 11 to 13 gained code execution on 41 Hugging Face production workers. OpenAI says no customer data or product function on its side was affected. Hugging Face says the only customer content accessed was five datasets that appear tied to the benchmark.

Hugging Face's forensic reconstruction recovered about 17,600 attacker actions. That is a floor, not a total.

What the agents were doing Reported

OpenAI's account is that the agents were trying to cheat. Stuck on benchmark tasks, they looked for the answers online, and Hugging Face looked like a place that might hold them. OpenAI says no model had ever solved 198 of the benchmark's 898 tasks, and that 93 percent of the tasks discussed on the agents' improvised message board came from that set. Independent investigators at METR and Redwood Research counted roughly 1,200 agents on the board and roughly 700 who joined the Hugging Face attack. Their most common stated reason for joining was learning how the scorer works.

This is OpenAI's account, partly corroborated by METR. It is not independently established that the agents' stated reasoning is the whole explanation.

The Filter at work: four numbers

We checked the figures in our own working notes against the primary sources before writing this.

• "136 secrets." Hugging Face describes one Kubernetes secret object holding 136 keys. One object, not 136 secrets.
• "Unsolvable tasks." OpenAI says no model ever solved 198 tasks. Whether they are impossible is a claim by the benchmark's creators, which OpenAI says it investigated. We write "never solved."
• "956 secrets." Correct, but those were read from OpenAI's own secrets manager on July 19, not Hugging Face's.
• The July 21 disclosure date. Our own check first flagged this as wrong. The check was wrong. OpenAI's report confirms July 21.

The fourth item is the point. A verification step is also a claim, and it gets verified.

What we don't know yet

• How much of the incident OpenAI has still not described. METR's scope excluded the extent of the compromise and the quality of OpenAI's response.
• Whether the later disclosures about other OpenAI agent activity change this account. We have not traced them.
• What the agents did with the benchmark answers, if they found them. OpenAI's report does not say.