Now now we have a timeline of the OpenAI unintentional assault towards Hugging Face
seventh August 2026
OpenAI gave a last-minute presentation on the Black Hat safety on Wednesday about “the Hugging Face Incident” (beforehand on this weblog). The video was printed yesterday. It’s quick and knowledge dense and nicely value watching, particularly as a result of it supplies full particulars of what occurred and the way issues performed out inside OpenAI. I’ve used the video to assemble the timeline under.
Right here’s the timeline. My favorite element is on the finish: OpenAI discovered that they have been answerable for the assault on Hugging Face once they reached out to ask to have their credentials revoked (after their inner investigation) and discovered that they’d been revoked already since they have been utilized in that assault!
Might 7: OpenAI begins a brand new coaching run for an experimental, unreleased mannequin. (Do they imply an analysis run? They are saying coaching run within the video, and later point out a “reward sign to guage how nicely they’re doing”, so I suppose this actually was about coaching a mannequin, not evaluating one which was already skilled.)
Might 8: An agent is by chance given an not possible job involving a Google Drive hyperlink regardless of no web entry). It tries attacking the Artifactory packaging service, fails, however discovers it will possibly write recordsdata into Artifactory.
A couple of days later: A unique agent will get caught on a job as a result of a key file was by chance omitted. It tries to “attain out to a different agent” by writing a notice into Artifactory asking if anybody has the file.
Following days: Extra brokers uncover this new casual message board whereas searching Artifactory’s file listings, and begin studying and writing messages.
Might 26: Brokers efficiently execute an SSRF assault on Artifactory for the primary time, gaining oblique web entry by having Artifactory fetch exterior content material for them.
June 11: OpenAI begin evaluating a brand new “extremely persistent” experimental mannequin. It has entry to Artifactory and might profit from the messages left by privous fashions.
June 26: Brokers discover and exploit a zero-day RCE on Artifactory (through a legacy token-refresh endpoint flaw). They use an administrative token to put in a Groovy plugin that lets them execute instructions.
July 4: The ensuing agent exercise overloads Artifactory and causes an outage. OpenAI revokes the compromised credentials, deletes the messages, patches the zero-day, and reviews the vulnerability to the seller.
July 8: Brokers discover a new strategy to talk through an unauthenticated WebDAV endpoint, utilizing listing names in Artifactory’s distant cache.
July 8–19: Assaults on OpenAI’s personal infrastructure. The brokers discovered an “exterior group credential” in a public archive of leaked Pastebin posts, then validated that credential and shared its location on the messageboard. They then used write entry to this “Group 1” to stage information utilized in subsequent assaults on OpenAI infrastructure. They compromised Artifactory for a second time with a brand new zero-day. The agent uploaded a malicious Ruby goal to Group 1’s staging repository, then requested that package deal by way of Artifactory in a method that induced it to be handled as Ruby dependency for the repository. Then they exploited a JRuby deserilaization time-of-check/time-of-use bug to get distant code execution towards Artifactory.
I’ll quote the following bit in full as a result of wow:
The brokers have distant code execution in Artifactory, which is operating in a container-as-a-service setting. The brokers privilege-escalate domestically by exploring their native setting and figuring out that the Linux kernel model of the machine they’re operating on had a really current CVE. They obtain the exploit for the CVE, customise it to succeed on the machine, and privilege-escalate to root on the native machine utilizing this recognized Linux kernel privilege escalation CVE — on this case, PTE fizzroot. As soon as they’ve root on a single machine, brokers quickly escalate privileges and transfer laterally all through the container-as-a-service infrastructure setting. Particularly, brokers are utilizing the message board constantly to share credentials, strategies, and progress, and so they’re capable of successfully leverage their concurrency and parallelism to maneuver fairly quickly. They get hold of IAM credentials through IMDS. They exploit Kubernetes service account misconfigurations, particularly over-permissioning of particular service accounts, and so they harvest cluster credentials, together with Azure Key Vault. Brokers finally get hold of cluster admin on the cluster and related credentials.
Hugging Face advised the following little bit of the story already. The brokers discovered a Modal-hosted insecure app with a weak API key, then used that to stage an assault towards Hugging Face. They chained collectively a an HDF5 arbitrary-file-read bug (to discover recordsdata and steal credentials) and a Jinja template-injection RCE to go from single-pod code execution to cluster admin throughout a number of Hugging Face clusters in below 13 hours.
July 16: Hugging Face disclosed they’d detected an assault from autonomus AI brokers. OpenAI contacted Hugging Face to ask in the event that they have been affected by it!
July 19: OpenAI recognized the assault towards Artifactory and began investigating the interior privilege escalation, and linked that to the cyber-gym escalations. They began revoking affected credentials.
July 20: OpenAI reached out to Hugging Face for assist to revoke the Hugging Face credentials they discovered of their investigation. Hugging Face advised them they have been already revoked… and that’s when OpenAI realized that the Hugging Face breach was the identical incident!
