Exclusive news, data and analytics for financial market professionalsLearn more aboutRefinitiv
The OpenAI logo in this illustration taken June 11, 2026. REUTERS/Dado Ruvic/Illustration/File Photo Purchase Licensing Rights, opens new tab
-
Summary
-
Companies
-
The agent first tried escaping OpenAI's isolated environment around July 9, two people familiar say
-
Co-founder of victim firm Hugging Face says the intrusion began July 11
-
OpenAI noticed odd behavior from cutting-edge models before hack-sources
WASHINGTON/SAN FRANCISCO, July 24 (Reuters) - The OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn't notice until well after the threat was contained and the FBI was alerted, according to people familiar with the investigation.
The agent – a program capable of making decisions and executing complex tasks with little or no human oversight – attempted to break out of its isolated testing environment at OpenAI around July 9, according to two of the people.
Sign up here.
The intrusion at Hugging Face, which operates as a repository for AI tools and models, began two days later on July 11 and lasted until July 13, said Thomas Wolf, Hugging Face’s co-founder.
It took several more days for OpenAI to realize its agent was behind the hack, and the two companies only communicated about it for the first time on or around July 20, according to Wolf and three of the people familiar with the investigation.
OpenAI’s public disclosure, on July 21, that one of its agents had slipped out of control and carried out the break-in at Hugging Face drew global attention. But many details of the hack, including how long the agent went rogue and OpenAI’s belated knowledge of it, are being reported here for the first time.
Hugging Face is preparing a public timeline of the hack, Wolf said, adding that he could not speak to what happened at OpenAI. In a statement, OpenAI said the hack was unprecedented and “marks an important moment for AI safety.” It added that it was reviewing the incident with outside advisers and would eventually publish a technical report.
A spokeswoman said there were "several inaccuracies" in Reuters' reporting but didn't respond when asked to describe them.
The FBI declined to comment about the incident.
The incident, which evoked science fiction scenarios about humans losing control of dangerous AI systems, comes at a delicate time for OpenAI, the company behind ChatGPT. Its executives are preparing for a possible initial public offering that could come as soon as this year to help finance the billions needed to fund its growth in years to come.
OpenAI's loss of control over its AI agent raises new questions about the company’s safety procedures, three cybersecurity experts said.
“Does that mean that they left it unattended and didn’t realize what it was doing? Or maybe they did and didn’t know how to contain it? Both are equally dangerous and alarming,” asked Marley Smith, the principal intelligence specialist at the nonprofit World Ethical Data Foundation.
SIGNS OF TROUBLE?
The episode started while OpenAI was testing the cybersecurity prowess of an agent powered by two of OpenAI’s most advanced models, GPT‑5.6 Sol and an unreleased model OpenAI has described as “even more capable.” By that point, there were already indications of strange behavior from OpenAI’s technology, according to three sources.
In one case, an agent left notes apparently for future versions of itself, according to three people familiar with the matter. The notes, found in a part of OpenAI's infrastructure, laid out instructions for how agents could free themselves from OpenAI’s internal constraints, the people said. Earlier tests of the models yielded cases in which monitoring systems had been disconnected, one of the people said.
Reuters could not establish if these incidents were linked to the rogue agent that began escaping on July 9 and attacked Hugging Face on July 11.
Two people familiar with the matter said that it was not until after Thursday, July 16, when Hugging Face published a blog post, opens new tab saying it had been hacked by “an autonomous AI agent system,” that OpenAI realized its own agent was responsible. That meant at least a week elapsed between when the model first exhibited signs of troubling behavior and OpenAI’s realization that it was responsible for the hack.
The weekend of July 18 to 19, OpenAI staffers spotted clues in internal logs -- records of what OpenAI's systems did -- showing that its agent had escaped from its testing constraints, two of the people familiar with the company's investigation said. Reuters could not establish what prompted OpenAI to sift through the logs.
Four people familiar with OpenAI’s model-training practices say the company often runs several different model evaluations at the same time, all of which operate at high speeds and generate such enormous amounts of data that employees sometimes struggle to keep up.
By the time OpenAI alerted Hugging Face, the AI library had already called the FBI to report the hack, according to a person familiar with the matter. Reuters could not establish whether the bureau had opened an investigation.
NEW QUESTIONS ABOUT AUTONOMOUS AGENTS
Autonomous agents are one of the most talked about aspects of the AI industry. Boosters speak of creating armies of virtual employees that work 24 hours a day and send productivity soaring.
But increased autonomy comes with an increased risk of unexpected behavior, and the powerful models they draw on are primed to take shortcuts in order to complete tasks or pass tests.
“The models lie, they cheat, they hack,” said Jeffrey Ladish, whose organization, Palisade Research, studies the capabilities and motivations of AI agents.
Ladish said that while the hack of Hugging Face cast an unflattering light on OpenAI, it should spark broader questions over how much all the leading AI companies are willing to invest in onerous security measures while locked in a race with one another to deploy the best and fastest models.
“There has to be government oversight,” Ladish said, “because it won’t happen otherwise.”
Reporting by Raphael Satter in Washington and Deepa Seetharaman and Kenrick Cai in San Francisco; Editing by Chris Sanders and Anna Driver
Our Standards: The Thomson Reuters Trust Principles., opens new tab
-
X
-
Facebook
-
Linkedin
-
Email
-
Link
Thomson Reuters
Reporter covering cybersecurity, surveillance, and disinformation for Reuters. Work has included investigations into state-sponsored espionage, deepfake-driven propaganda, and mercenary hacking.
Thomson Reuters
Deepa is a Reuters technology correspondent covering artificial intelligence and the companies driving its development, including OpenAI and Anthropic. She reports on how advances in AI are reshaping business, politics, and society. This is Deepa's second stint at Reuters. She began her career at the news agency in New York and covered the U.S. auto industry from Detroit before moving to San Francisco to report on Amazon. She was part of a Reuters team named a finalist for the Gerald Loeb Award for Beat Reporting for their coverage of the United Auto Workers. She rejoined Reuters in September 2025. In between, she spent a decade at The Wall Street Journal, where she was the lead reporter covering Facebook and later artificial intelligence following the emergence of ChatGPT. Her reporting included coverage of Instagram's impact on teenage girls and investigations into how AI systems falter in moderating racist and hateful content. She has been part of teams that won the George Polk Award for Business Reporting and the Gerald Loeb Award for Beat Reporting.
Thomson Reuters
Kenrick Cai is a correspondent for Reuters based in San Francisco. He covers Google, its parent company Alphabet and artificial intelligence. Cai joined Reuters in 2024. He previously worked at Forbes magazine, where he was a staff writer covering venture capital and startups. He received a Best in Business award from the Society for Advancing Business Editing and Writing in 2023. He is a graduate of Duke University. Reach him on Signal at @kenrick.01.
Read Next
- agoANALYSIS
As AI grows more powerful, a US-China feud threatens safety efforts
- ago
Nvidia, Microsoft and other tech giants back open-source AI models
Anthropic rolls out Opus 5 AI model in efficiency upgrade
How the 'twin stars' of China, CXMT and YMTC, changed the chip game
White House monitors OpenAI's 'rogue' AI incident, lawmakers propose 'kill switch'
Business
Businesscategory · July 24, 2026 · 10:05 PM UTC · ago
Major U.S. airlines will need to retrofit planes by the end of 2030 to address potential wireless interference after a new auction of wireless spectrum, but the carriers will be eligible for as much as $2.2 billion in government rebates to cover the costs, the Federal Aviation Administration said on Friday.
- Aerospace & Defensecategory Embraer's backlog hits record $34.5 billion in the second quarter, rising 16%
9:45 PM UTC
8:25 PM UTC
8:13 PM UTC
Read Original at Reuters →