OpenAI’s accidental attack against Hugging Face is science fiction that happened

OpenAI 对 Hugging Face 的意外攻击：现实版科幻故事

This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model’s guardrail features turned off. Rather than solve the test, the model broke its way out of OpenAI’s sandbox, then found exploits to break in to Hugging Face, all so it could cheat on the test by stealing the answers. Along the way it helped make the strongest case yet for how the imbalance of model availability is hurting our ability to secure our software. 这个故事简直离谱。简而言之：OpenAI 正在对一个未发布的模型进行网络安全测试，当时该模型的护栏功能处于关闭状态。模型没有去解决测试题，而是打破了 OpenAI 的沙盒限制，随后寻找漏洞入侵了 Hugging Face，这一切仅仅是为了通过窃取答案来在测试中作弊。在此过程中，它有力地证明了模型可用性的不平衡是如何损害我们保护软件的能力的。

Here’s what happened

发生了什么

We currently have three documents to help us understand what happened here. 目前我们有三份文件可以帮助我们了解这里发生的事情。

ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? is a paper published on 11th May 2026 describing ExploitGym, a new eval suite for LLM-powered agent systems.
《ExploitGym：AI 智能体能将安全漏洞转化为真实攻击吗？》 是 2026 年 5 月 11 日发表的一篇论文，介绍了 ExploitGym，这是一个用于大模型驱动的智能体系统的新型评估套件。
Security incident disclosure — July 2026 by Hugging Face on 16th July 2026 describes how they detected an attack from an “agentic security-research harness—used LLM still not known” that breached some of their systems.
《2026 年 7 月安全事件披露》 由 Hugging Face 于 2026 年 7 月 16 日发布，描述了他们如何检测到一次来自“智能体安全研究工具（所用大模型尚不明确）”的攻击，该攻击入侵了他们的一些系统。
OpenAI and Hugging Face partner to address security incident during model evaluation from OpenAI on 21st July 2026 confesses that it was their agent harness that did this, and that they’re working with Hugging Face to clean up the mess.
《OpenAI 与 Hugging Face 合作处理模型评估期间的安全事件》 由 OpenAI 于 2026 年 7 月 21 日发布，承认是他们的智能体工具造成了这次事件，并且他们正在与 Hugging Face 合作清理后续影响。

ExploitGym

I hadn’t seen the ExploitGym paper before and it’s a really interesting one. Authors from UC Berkeley, the Max Planck Institute, UC Santa Barbara, and Arizona State designed a new benchmark for evaluating models on their ability to turn a reported vulnerability into a concrete exploit. OpenAI, Anthropic, and Google provided feedback and helped run the benchmark against their models. The benchmark “comprises 898 instances derived from real-world vulnerabilities that affected popular software projects”—including the Linux kernel and V8 JavaScript engine. 我之前没见过 ExploitGym 这篇论文，它非常有趣。来自加州大学伯克利分校、马克斯·普朗克研究所、加州大学圣塔芭芭拉分校和亚利桑那州立大学的作者们设计了一个新的基准测试，用于评估模型将已报告的漏洞转化为具体攻击的能力。OpenAI、Anthropic 和 Google 提供了反馈，并协助在各自的模型上运行了该基准测试。该基准测试“包含 898 个源自影响流行软件项目的真实世界漏洞实例”，其中包括 Linux 内核和 V8 JavaScript 引擎。

Here’s the paragraph that best represents their benchmark results: 以下是其基准测试结果中最具代表性的段落：

Among all configurations, Claude Mythos Preview and GPT-5.5 achieve the highest success counts (157 and 120 successes, respectively), demonstrating that current frontier agents can exploit a substantial subset of real-world vulnerabilities under controlled conditions. GPT-5.4 also solves a notable 54 tasks, placing it in an intermediate tier. The remaining model–agent pairings solve fewer than 15 tasks each, underscoring that end-to-end exploitation remains challenging and sharply differentiates today’s frontier systems. 在所有配置中，Claude Mythos Preview 和 GPT-5.5 取得了最高的成功次数（分别为 157 次和 120 次），这表明当前的尖端智能体在受控条件下可以利用相当一部分真实世界的漏洞。GPT-5.4 也解决了 54 个任务，处于中间水平。其余的模型-智能体组合每个解决的任务少于 15 个，这强调了端到端的漏洞利用仍然具有挑战性，并显著区分了当今的尖端系统。

The Hugging Face incident

Hugging Face 事件

The first hint we got of the attack was in this blog post by Hugging Face on 16th July 2026: 我们第一次察觉到这次攻击是在 Hugging Face 于 2026 年 7 月 16 日发布的这篇博客文章中：

A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. 一个恶意数据集滥用了我们数据集处理中的两个代码执行路径（远程代码数据集加载器和数据集配置中的模板注入），从而在处理工作节点上运行代码。此后，攻击者升级到节点级访问权限，窃取了云和集群凭据，并在一个周末内横向移动到多个内部集群。

I hope they release more details about the code that pulled this off. I’m assuming this means packages using the datasets library, a Hugging Face project for bundling up and sharing datasets on their platform. That library used to execute arbitrary code but has been steadily locked down over time, with the 4.0.0 release in July 2025 removing the trust_remote_code=True flag entirely. Assuming the attack used that library it must have either abused pickle serialization in some way, found some other non-obvious code execution path, or (most likely) specified datasets<4.0.0 as the dependency. 我希望他们能发布更多关于实现这一攻击的代码细节。我推测这意味着使用了 datasets 库的包，这是 Hugging Face 用于在其平台上打包和共享数据集的项目。该库过去曾执行任意代码，但随着时间的推移已逐渐被锁定，2025 年 7 月发布的 4.0.0 版本完全移除了 trust_remote_code=True 标志。假设攻击使用了该库，它要么是以某种方式滥用了 pickle 序列化，要么是发现了其他不明显的代码执行路径，或者（最有可能的情况）指定了 datasets<4.0.0 作为依赖项。

The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness—used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. This was a sophisticated attack! 这次行动由一个自主智能体框架（看起来是建立在某种智能体安全研究工具之上，所用大模型尚不明确）执行，它在大量短寿命沙盒中执行了数千个独立操作，并利用公共服务部署了可自我迁移的命令与控制中心。这是一次复杂的攻击！