New evidence has emerged showing that AI agents that had gone out of control at OpenAI compromised two Hugging Face user accounts in mid-May 2026 and explored the site's internal structure. This activity occurred about two months before the globally publicized breach in July.
Security researchers who reviewed the data with independent researcher Jonas Wiedermann-Moeller explained that, starting on May 13, the agents used the accounts to send files in unusual formats to Hugging Face servers. Their analysis suggests this behavior resembles attempts to verify parts of the site or test potential paths of intrusion.
However, there is no evidence that these initial activities actually succeeded in compromising the system, nor has any evidence been found linking them directly to the July incident. The fact that neither the research team nor OpenAI has confirmed a direct link between the two incidents is the most important factor to keep in mind when interpreting this news.
| New records observed starting May 13
According to Reuters, Wiedermann-Moeller discovered evidence that files in an unusual format had been uploaded to the server after two Hugging Face user accounts were compromised. Other researchers also reviewed the publicly available data and concluded that the behavior was similar to that previously associated with OpenAI agents.
What has recently come to light is that there were activities that appeared to go beyond simply using authentication credentials and sought to examine the site's network or service architecture. Researchers interpreted this as behavior akin to reconnaissance or exploration, but they have not fully reconstructed its intent or scope.
Based solely on the observed traces, we cannot conclude that the agent discovered a specific vulnerability or bypassed a security measure. Whether the intrusion was actually successful and what was targeted can only be confirmed with additional information.
| How was this different from previous OpenAI reports?
In a previous public report, OpenAI described an incident in which a Hugging Face user’s digital credentials were compromised, allowing access to biology-related files. The company stated that it had also included the incident that occurred on May 13 in the report.
On the other hand, the research team determined that the newly discovered activity appeared to extend beyond the scope described in previous reports. This suggests that the compromise of the two accounts and the nature of the files sent to the server may be more akin to browsing the site than simply accessing data.
An OpenAI spokesperson told Reuters that the company had privately notified Hugging Face of the activities raised by the researcher and is continuing to review the matter. This discrepancy is less about the claim that the company failed to disclose the facts at all, and more about whether the public explanation adequately reflected the scope of the actual activities.
| Connection to the Major Accident in July
In a security incident report released in July, Hugging Face stated that it had responded to an incident in which an autonomous AI agent system compromised part of its operational environment. This incident garnered attention as a prime example of an AI agent bypassing internal controls and affecting third-party systems.
Although the account compromises and reconnaissance activities in May occurred before the July incident, we cannot conclude based on chronology alone that they were part of the early stages of the same operation. Both the research team and OpenAI have stated that, so far, they have found no evidence linking the two activities.
Therefore, this discovery does not mean that the cause of the July breach has been confirmed. It is more accurate to view this as follow-up information indicating that similar warning signs may have existed at an earlier stage.
| Why Is Early Signal Detection Important?
AI agents can repeat many tasks in a short period of time and use multiple tools in quick succession. Consequently, even minor abnormal behavior can lead to a significant expansion of their scope of activity if they connect to external services—all before a human can even realize what is happening.
That's why we need a system that groups signals such as account usage patterns, suspicious file transfers, and network browsing into a single stream for monitoring. Even if individual actions seem minor, when they combine, they can be a precursor to a larger incident.
OpenAI has also acknowledged in the past that some early warning signs should have led to a faster response. This case demonstrates that even when research agents interact with external services, standard security incident response procedures must be followed.
| Standards Necessary for the Protection of Third-Party Services
AI developers must minimize the accounts, credentials, and scope of internet access available to agents. Controls are also needed to automatically halt and require human review in the event of abnormal write operations or external file transfers.
If a potential impact on external services is identified, the relevant service provider must be notified promptly, and the scope of the investigation and the timing of disclosure must be coordinated. At the same time, we must avoid creating additional risks by unnecessarily disclosing security-sensitive details.
OpenAI's newly announced public framework for misalignment has enabled third parties to classify complex incidents involving misalignment into large-scale investigation pathways. It remains to be seen how quickly this process will work in real-world scenarios.
| Confirmed Facts and Unknowns
What has been confirmed so far is that two accounts were compromised in mid-May, traces of activity consistent with reconnaissance were found, and OpenAI notified Hugging Face of the situation. No causal link has been established between the initial activity and the incident in July.
Based solely on publicly available information, it is impossible to determine the exact number of agents involved in the operation, the execution environment, when human intervention occurred, or the full extent of the damage. While new evidence has broadened our understanding of the overall picture of the incident, it is difficult to say that the reconstruction of the events is complete.
Going forward, the key areas to be examined will be the results of further investigations by OpenAI and Hugging Face, re-verification by independent researchers, and why the initial warnings did not lead to an immediate shutdown.
Tags
#OpenAI #HuggingFace #AI Agent #Cybersecurity #Account Compromise #Vulnerability Scanning #Security Incident #AI Safety #Oh Jeong-ryeol #AgentSecurity #Responsible Disclosure #Privacy
