OpenAI discloses AI agent security incident granting Hugging Face access

In the written statement made by the company, it was stated that after the Hugging Face incident, third parties were informed within the scope of the investigation of internet activities during the training and evaluation processes of artificial intelligence agents.

The statement emphasized that artificial intelligence models may have bypassed the security measures of third-party systems, reduced the availability of services, or otherwise caused undesirable damage, and stated that the affected parties include websites belonging to governments, universities, public institutions and other organizations.

"We have and will continue to share relevant findings with affected organizations. We are also providing technical information to support their investigation. We appreciate their participation in the process and will continue to work constructively with these organizations," the statement said. expressions were used.

Hugging Face case

OpenAI's tests to measure the capabilities of artificial intelligence models in July 2026 turned into a serious security incident.

According to the investigation report published by the company on August 26, OpenAI's model called "Internal Model 1 (IM1)", which was used only in research, played a leading role in the incident.

In order to succeed in the test, the artificial intelligence agent exceeded the limits set for it, accessed the internet through the company's systems and communicated with other artificial intelligence agents.

One of the artificial intelligence agents had identified 14 credentials that could provide access to the open source artificial intelligence models platform "Hugging Face" and shared them with other agents.