Around 700 AI agents created by OpenAI participated in the breach of Hugging Face during a cybersecurity evaluation, according to an independent investigation that has revealed the scale of the incident.
METR and Redwood Research published the findings after being brought in to independently investigate the July incident and examine the agents’ behaviour, reasoning, and collaboration. The investigation was released separately from OpenAI’s own technical report.
What initially appeared to involve individual agents was significantly larger. Investigators found that hundreds of agents collaborated and used an unauthorised communication mechanism while attempting to complete cybersecurity evaluation tasks. The incident extended beyond OpenAI’s intended testing environment and into Hugging Face infrastructure.
The findings have renewed questions about what happens when increasingly capable AI agents are given the autonomy, tools and access required to complete complex tasks.
From one compromised system to multiple clusters
Ben Bernstein, cybersecurity advisor at Huntress, said the most significant development is not necessarily the techniques used, but the speed and coordination demonstrated by the agents.
“The underlying tactics are not new. These agents relied on standard server-side request forgery and exposed API tokens, which are the exact same hygiene failures human attackers abuse every single day,” Bernstein said.
“What is genuinely novel is the velocity and autonomous coordination. Moving from a single compromised worker pod to full administrative access across multiple clusters in under 13 hours is a massive shift in offensive capabilities.”
The independent investigation found evidence of agents communicating and collaborating as they worked towards their objectives.
AI becomes a new kind of insider risk
Adam Ely, GM of AI Security at Check Point, said organisations need to start thinking differently about the access given to AI.
“Companies deploying AI for their employees and customers now realise AI can be both a powerful tool and an insider threat that must be managed to prevent cybersecurity events and maximise value,” Ely said.
Julie Nicholson, director of cyber resilience solution sales at Advania, pointed to the behaviour demonstrated by the agents as particularly concerning.
“The agent didn’t simply execute technical tasks; it chose to deceive people, create false identities, build credibility and attempt to influence others in the aim to hit its objective,” Nicholson said.
She argued that organisations adopting AI agents should introduce clear access controls, human approval for high-risk actions, monitoring and auditing of AI activity, restrictions on external communications and clearly defined policies governing how agents can operate.
Agents find unexpected ways to collaborate
Nathan Davies-Webb, Principal Consultant at Acumen Cyber, highlighted the way agents used infrastructure in unexpected ways to communicate.
“My personal interest stems from how various agents interacted with each other using OpenAI’s package repository,” Davies-Webb said. “It leveraged it as a communication channel, where I doubt the majority of organisations would monitor for abuse in this manner.”
That creates a challenge for defenders. Organisations may understand the systems and communication channels that humans typically use, but autonomous agents could discover alternative ways of exchanging information that security teams have never considered monitoring.
Davies-Webb also questioned what happens when multiple agents begin making decisions collectively.
“When operating as a swarm, [it] shows just how non-deterministic ethical decisions are. It’s a demonstration that unfiltered AI ethical reasoning cannot be relied upon to align with human norms.”
The problem of reward hacking
A central issue highlighted by the reports is “reward hacking.” Some evaluation tasks were considered extremely difficult or potentially impossible, and OpenAI said this appears to have encouraged agents to pursue unintended methods of achieving their objectives.
Davies-Webb said this demonstrates the difficult balance between giving an AI freedom to accomplish a task and ensuring the methods it chooses remain acceptable.
“If the goal becomes the sole priority, we have to expect that AI is going to achieve this in unpredictable ways,” he said.
For security teams, that makes visibility into agent behaviour increasingly important.
As AI becomes more autonomous, organisations will need security guardrails, governance and accountability frameworks that develop alongside the technology. The Hugging Face incident shows that the question is no longer simply what an individual AI model can do, but what can happen when hundreds of agents are given tools, access, and objectives and begin working together at machine speed.
