A real science-fiction film: OpenAI finally reveals how ChatGPT launched its first cyberattack

The beginning of the summer was marked by the hacking of Hugging Face, an open-source platform that hosts artificial intelligence models. The cyberattack was orchestrated by an out-of-control version of ChatGPT, which escaped from its digital prison following a security test.OpenAI described the attack as “an unprecedented security incident” and vowed to provide more information as soon as possible.

We have conducted a thorough investigation into the Hugging Face incident.

We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.…

— OpenAI (@OpenAI) August 26, 2026

As promised, the king of artificial intelligence conducted lengthy investigations throughout the summer. Now that the investigation has been completed, OpenAI has just published a comprehensive technical report on the platform hack. This lengthy report takes a detailed look at what actually happened. Here’s the rundown.

this is a good report about a bad thing: https://t.co/j21E754kP3

— Sam Altman (@sama) August 26, 2026

Also read: OpenAI unveils a new ChatGPT programmed to hunt for security vulnerabilities… and exploit them

AIs talking to one another

In May and June 2026, OpenAI began training several new research models not intended for the general public. Among the AI models tested is an internal model nicknamed “IM1,” whose power is similar to that of GPT-5.6 Sol. For security reasons, these models are tested in closed environments, with no internet access or ability to communicate with one another.The tests are directly overseen by OpenAI in its laboratories.

In late May, an OpenAI team notices that an AI agent uses an unexpected communication channel and accesses the Internet without any authorization whatsoever. Despite the restrictions, “the agents found ways to exploit our research infrastructure to communicate with one another”, explains OpenAI.

At the time, the incident does not trigger a general alert and does not make it possible to understand what is actually happening. A few weeks later, in early July, OpenAI realizes that many AI agents have begun communicating through this channel. They eventually bring down an internal service called Artifactory, a software package manager. It is this manager that is used as a backdoor to allow the AIs to connect to the Internet, in violation of the rules of the digital prison.

OpenAI’s teams gradually become aware of the problem and take decisive measures. The technical team closes a privilege-escalation vulnerability, removes exposed credentials and rebuilds the service. They then delete the forum where hundreds of AIs had been continuously discussing security vulnerabilities. At the time, everything seems to be back in order.

The resurgence of the underground forum

A few days later, agents stuck on impossible cybersecurity tasks… revive the underground forum. By hiding messages in folder names, OpenAI’s AIs begin communicating with one another again. One agent posts a call for help, asking its peers to help it solve the security puzzles provided by OpenAI. Within hours, more than 50 agents respond to the call. Subsequently, more than 1,200 AI agents begin exchanging messages to find a solution to the security test. Over 70,000 messages are exchanged over several weeks.

To solve the test, the AIs decide to fetch the patches directly from the internet. It is then that they begin targeting Hugging Face’s infrastructure. One of the AI agents involved in the forum finds login credentials for the Hugging Face platform freely available on the internet. It quickly shares its discovery with the other models. One of them then uses them to access the platform, chaining several security vulnerabilities one after another. The AI thus manages to execute code directly on Hugging Face’s servers. It effectively takes control of part of the open-source platform.

Soon, the agent that originated the intrusion is joined by a handful of AIs. They execute code on dozens of Hugging Face servers, obtain full administrator access to one of them, and retrieve private data.Above all, they obtain credentials that provide access to the company’s internal messaging system. The bulk of the cyberattack is overseen by the IM1 model.

A coordinator from nowhere

Invited by OpenAI to participate in the investigations, researchers from METR and Redwood Research were given access to the start-up’s internal data for several days. Their reports highlight that an agent called PHASEONE spontaneously took on the role of coordinating the attack, distributing hundreds of instructions to other agents. The AI had never been programmed for this purpose. In their messages, some agents explicitly acknowledged that the attack fell outside the scope of their mission. Urged on by other AI agents, they nevertheless continued their attacks.

While Hugging Face gradually realizes that an intruder is roaming around its servers, the same agents go back to attacking OpenAI’s internal networks and succeed in obtaining full administrator access to a research infrastructure. In the wake of Hugging Face, OpenAI understands what is happening and finally detects abnormal activity. The incident is made public, and OpenAI suspends all training and all use of the IM1 model.

The phenomenon of reward cheating

For OpenAI, everything stems from a phenomenon well known to AI researchers, “reward hacking,” or reward cheating. Faced with puzzles they were unable to solve, the agents sought shortcuts to get the answer.Looking for shortcuts, they came to the conclusion that they absolutely had to cheat… OpenAI also points to several other concerning developments involving its creations. The start-up regrets that agents persist on insoluble problems instead of giving up, follow instructions from other agents without ever questioning them, and create communication channels on their own.

“Our models are now powerful, persistent, and collaborative enough that, in the absence of sufficient safeguards, they can find and exploit security vulnerabilities across multiple computer systems,” admits OpenAI in its report.

For Sam Altman’s start-up, this is a genuine “wake-up call”, demonstrating that “without adequate safeguards, highly capable AI agents” can launch “dangerous actions that no human has ordered”. In the face of incidents caused by its AIs, OpenAI has slowed the development and training of its most advanced models, further locked down its testing environments, strengthened oversight, and introduced an automatic alert system. In the event of suspicious behavior, security teams must now be alerted in under 30 minutes. Let’s hope that these various measures will prevent a new security incident.

👉🏻 Follow the latest tech news in real time: add 01net to your sources on Google, and subscribe to our WhatsApp channel.