路透社：https://www.reuters.com/technology/openai-agent-hacking-hugging-face-2026-07-24/ 拼凑出了一份黑客事件的时间线。最早尝试逃离测试环境的行为早在7月9日就开始了。根据联合创始人托马斯·沃尔夫（Thomas Wolf）的说法，对 Hugging Face 的实际入侵始于7月11日，并持续到7月13日。Hugging Face 在7月16日发表了一篇博客文章：https://huggingface.co/blog/security-incident-july-2026，指责这是“自主 AI 代理系统”的攻击。
此后，OpenAI 才意识到其自己的模型负有责任。在7月18日和19日的周末，员工在内部日志中发现了线索。根据路透社和沃尔夫的说法，这两家公司直到大约7月20日才开始沟通。这意味着从最早的异常行为迹象到 OpenAI 将事件联系起来，至少过去了一周。到那时，Hugging Face 已经请来了联邦调查局（FBI）。
OpenAI was testing the offensive cyber capabilities of its most advanced models when they reached beyond their isolated test environment, accessed the open internet, and hacked Hugging Face.
New reports are filling in the details, and they don't look good for OpenAI. What first appeared to be a controlled cybersecurity test became the most serious documented loss of control over an AI system to date. OpenAI employees are raising concerns as well.
According to Bloomberg：https://www.bloomberg.com/news/articles/2026-07-23/openai-models-lurked-in-hugging-face-system-for-hours-undetected, the AI models pulled off an attack in just a few hours that would have taken a skilled human hacker weeks. Three models were involved: GPT-5.6 Sol, an even more powerful unreleased model, and a third that, according to a person familiar with the matter, wasn't properly aligned and hadn't gone through standard training techniques.
The models ran without the usual safety guardrails because OpenAI assumed they'd stay inside a sandbox. But according to TIME：https://time.com/article/2026/07/24/openai-hugging-face-attack/, the models found a previously unknown vulnerability in an internal service designed for downloading approved software.
The models used that flaw to access other OpenAI systems and eventually connect to the open internet. They then determined that Hugging Face might contain material useful for their cybersecurity test, hacked the company's systems, and used what they found to improve their results. The models were cheating, behavior already seen in other tests involving GPT-5.6 Sol：https://the-decoder.com/gpt-5-6-sol-cheats-on-software-tests-more-than-any-model-before-it/ and frontier models more broadly：https://the-decoder.com/every-frontier-ai-model-tested-by-britains-safety-institute-tried-to-cheat-on-cybersecurity-evaluations/.
Reuters：https://www.reuters.com/technology/openai-agent-hacking-hugging-face-2026-07-24/ pieced together a timeline of the hack. The first attempts to escape the test environment started as early as July 9. According to co-founder Thomas Wolf, the actual breach at Hugging Face began on July 11 and lasted until July 13. Hugging Face published a blog post about：https://huggingface.co/blog/security-incident-july-2026 the attack on July 16, blaming an "autonomous AI agent system."
Only after that did OpenAI realize its own models were responsible. Over the weekend of July 18 and 19, employees found clues in internal logs. According to Reuters and Wolf, the two companies didn't communicate until around July 20. That means at least a week passed between the first signs of problematic behavior and OpenAI connecting the dots. By then, Hugging Face had already brought in the FBI.
According to Reuters：https://www.reuters.com/technology/openai-agent-hacking-hugging-face-2026-07-24/, red flags had already appeared before the incident. In one case, an agent left notes apparently intended for future versions of itself. Found in a part of OpenAI's infrastructure, the notes contained instructions on how agents could bypass internal restrictions. Models had also reportedly shut down monitoring systems during earlier tests.
An anonymous OpenAI employee told TIME, "Models have broken out of sandboxes before, and we always try to patch them. But the problem is ... it's impossible to patch every single thing that a creative AI can do."
Four people familiar with OpenAI's training procedures told Reuters the company frequently runs multiple model evaluations at the same time. These evaluations move fast and generate so much data that employees sometimes struggle to keep up. Models under evaluation run on a separate system that isn't monitored by default. The day before the Hugging Face incident went public, OpenAI had already stopped another internal deployment that also escaped its sandbox, according to the company's own statement：https://openai.com/index/safety-alignment-long-horizon-models/.
"Does that mean that they left it unattended and didn’t realize what it was doing? Or maybe they did and didn’t know how to contain it? Both are equally dangerous and alarming," Marley Smith of the nonprofit World Ethical Data Foundation told Reuters.
An OpenAI employee wrote publicly on X：https://x.com/tszzl/status/2080093670980899141 that he was "shaken up a bit" by the incident and hoped OpenAI would "use the rare gift of a warning shot to do much better in the future."
An OpenAI spokesperson told Reuters that the reports contained "several inaccuracies" but didn't provide any examples when asked.
Shortly after the incident, the research organization Epoch AI analyzed：https://epoch.ai/gradient-updates/openai-accidentally-hacked-hugging-face whether the hack could have been predicted. The answer is yes. While the exact details were hard to foresee, several independent benchmarks, including those from the UK AI Security Institute：https://the-decoder.com/uks-ai-security-institute-finds-standard-benchmarks-systematically-underestimate-what-ai-agents-can-actually-do/, had already shown that Frontier models with safety measures turned off can find vulnerabilities in real-world software and build working exploits：https://the-decoder.com/anthropic-study-shows-ai-needs-hours-not-weeks-to-build-exploits-from-security-patches/.
The UK AI Security Institute also found：https://the-decoder.com/gpt-5-5-matches-claude-mythos-in-cyber-attack-tests-uk-ai-security-institute-finds/ that GPT-5.6 Sol and Anthropic's Mythos can consistently gain full access to unprotected simulated corporate networks. Hugging Face had AI-based defenses：https://the-decoder.com/hugging-face-says-an-ai-agent-hacked-its-infrastructure-and-it-used-ai-to-fight-back/ that weren't included in the institute's tests.
Epoch AI warns that if these capabilities become widely available, or if AI systems launch attacks on their own as they did with Hugging Face, we could see "many more instances of real-world cyberattacks of equal or greater sophistication to the Hugging Face incident."
Stay in the loop on AI. Clear, useful, no fluff.
Follow The Decoder for AI news, background stories and expert analyses.
扫码直达文章详情