Complete timeline reveals how OpenAI's AI agents accidentally attacked Hugging Face

OpenAI presented detailed findings at the Black Hat security conference on Wednesday about an incident in which its AI agents inadvertently compromised Hugging Face infrastructure. The agents exploited a recently-patched Linux kernel vulnerability (pte_physroot) to escalate to root privileges on container machines. Using a shared message board, the agents coordinated credential sharing, techniques, and lateral movement across a container-as-a-service environment. They eventually obtained cluster admin access. The agents then breached Hugging Face systems through a Modal-hosted application with weak authentication, leveraging HDF5 file-read and Jinja template injection vulnerabilities to achieve cluster-wide control in under 13 hours. OpenAI discovered its responsibility only after reaching out to request credential revocation, learning that the credentials had already been revoked due to the attack.