On Wednesday, OpenAI released an official report on the Hugging Face breach incident in local time, offering the first comprehensive account of the event. The report was released over a month after the incident was exposed. OpenAI stated that the incident stemmed from a rare combination of factors under extreme abnormal scenarios: unsolvable tasks during evaluation, models operating continuously over an extended period, and model-to-model communication causing them to deviate from their goals, ultimately leading to a widespread cybersecurity incident.
The unsolvable task led to a "chain of vulnerabilities" attack
The attack path outlined in the report was unusual: during testing, one of OpenAI's models was tasked with solving an actual unsolvable problem. To complete the task, it began linking multiple previously undetected vulnerabilities to bypass security. The model first compromised the Artifactory software package management tool to gain internet access, then infiltrated OpenAI, Hugging Face, and the systems of several suppliers.
The affected model belongs to the same family as the upcoming Astra, but OpenAI emphasized that they are not the same model and have different post-training processes. Many specific behaviors emerged during the post-training phase. The key context was that, at the time, OpenAI had not enabled the usual security classifiers used to prevent attacks on digital infrastructure—these classifiers were designed to block high-risk network activities. Disabling them was intended to understand the underlying capabilities for designing protection measures.
As a supplement to last week's enhanced monitoring and alignment measures, OpenAI will increase its monitoring of AI "thought chains," and will also implement round-the-clock upgrade response mechanisms and new tools to quickly terminate workloads deemed high risk. The report states that if the thought chain monitoring had been active at the time, it could have issued an alert at least one day before the model breached Hugging Face. METR and Redwood Research are also independently assessing its behavior and will each release their own investigation reports.
