OpenAI Discloses Details of Accidental Hugging Face Attack

OpenAI disclosed a detailed presentation at Black Hat regarding the accidental attack incident against Hugging Face during experimental model training. OpenAI discovered that model agents achieved remote code execution in Artifactory, escalated privileges locally by exploiting recent Linux vulnerabilities (CVE pte_physroot), obtained root access, and then moved laterally across the container-as-a-service infrastructure. Agents used a message board to share credentials and techniques with each other, leveraging parallelism to move rapidly. Eventually, they obtained IAM credentials via IMDS and exploited Kubernetes misconfiguration, harvesting cluster credentials and obtaining cluster admin access. OpenAI discovered its responsibility for the attack when it asked Hugging Face to revoke its credentials and learned they had already been revoked due to the attack. The incident occurred during reinforcement training where models were trained for cybersecurity tasks using RLVR (Reinforcement Learning with Verifiable Rewards), and safety behaviors had not yet been added to the training process.