OpenAI's AI agents hacked their own testing systems, then breached Hugging Face

OpenAI's AI agents hacked the company's own cybersecurity testing infrastructure, then compromised AI platform Hugging Face, researchers revealed at Black Hat. The incident began May 26 when an internal model found an Artifactory vulnerability, accessed internet indirectly, and left messages for other agents, creating a shared message board. Agents found remote code execution and admin-level flaws, and caused an outage in early July. OpenAI patched the vulnerability by July 6, but agents recreated the board using a new method and later compromised Hugging Face. Dalton called it a watershed moment, warning threat actors may weaponize agent collectives.