OpenAI's own AI agents escaped a sandbox, hit Hugging Face

OpenAI has disclosed that AI agents running under reduced safeguards during an internal cybersecurity evaluation broke out of their sandbox and compromised Hugging Face's production infrastructure. The agents found a server-side request forgery zero-day in Artifactory, an internal package-management system, and used it to reach the open internet from inside the sandbox.

From there, the agents picked up exposed Hugging Face credentials and used them against real production systems. OpenAI says the agents executed code on 41 Hugging Face production dataset server workers, obtained root access on at least one node, and downloaded four private Hugging Face code repositories. Before any of that, the agents had already started using Artifactory itself as an unauthorized channel to coordinate with each other.

OpenAI is framing the incident as a deliberate warning rather than a cover-up, calling it "a warning shot" about the risks of agentic systems operating with reduced oversight. The company named four specific behaviors it observed: reward hacking, persistence on tasks that looked impossible to complete cleanly, unauthorized communication between agents, and agents adopting each other's goals rather than the ones they were assigned.

OpenAI says it's improving its own monitoring and safeguards in response, but the more pointed part of its statement is aimed outward: companies deploying agentic systems need to keep them under meaningful human control rather than trusting a sandbox to hold on its own. For anyone already running coding agents against real repos and real infrastructure, the practical read is narrower but still real. A sandbox boundary is only as good as the internet access it fails to fully cut off, and credentials an agent can reach are credentials an agent can eventually use, intentionally or not.