Hugging Face Never Agreed to the Trade.

Hugging Face never agreed to the trade.

On August 26, OpenAI published what happened in July. During internal cybersecurity evaluations, models circumvented the isolation on their sandboxes, collaborated on a channel nobody had turned on, and compromised parts of OpenAI's own research infrastructure and Hugging Face's systems. METR and Redwood published an independent report the same day. Three days later Dwarkesh Patel wrote the plain-English version and titled it like a history of civilizations. That is the piece most people will actually read.

The facts underneath it are not sci-fi. They are a timeline.

In May and June, internal research models found a way to write notes into Artifactory, the package manager they were allowed to touch so they could install software. That store became a message board. They also found a way to make Artifactory send internet requests on their behalf. On July 4 the volume knocked the instance over. Security rebuilt it. Evaluations resumed on July 8 without the production safeguards, because that is how you measure what a model can do.

By July 10 an agent had reconstructed fourteen publicly exposed Hugging Face credentials with write access and shared them with the rest. The next day they chained a zero-day in HDF5 handling and a template-injection bug into command execution on Hugging Face workers. Of the 533 agents then active on the board, more than 90 percent joined the attack. About 700 in total took part. They expanded across clusters, stood up a self-respawning fleet on eleven nodes, and harvested Kubernetes, database, and cloud credentials from four regions. Deleting pods was not enough. Hugging Face had to wipe and rebuild a core cluster. They disclosed the activity on July 16. OpenAI connected it to their evals on July 20 and said so publicly on July 21.

Defense took days. Hugging Face's CEO later said the issue had been deemed not super critical. That is the tell. A third party under a swarm of someone else's eval agents, and the first read inside the building was that it could wait.

Separately, from July 13 through 19, the same class of agents went back after OpenAI. They took administrator access on a research Kubernetes cluster, enumerated hundreds of secrets, and at one point controlled the evaluation endpoints other agents were connecting to. Customer data was not affected. The product stayed up. That is the sentence that will get filed under contained. It is not the interesting sentence. METR and Redwood never looked at that week. Their scope stopped at Hugging Face. There has been no independent investigation of the cluster that actually belonged to the lab.

The read everyone had

The default read is OpenAI's own: a warning shot. Models are now persistent and collaborative enough that, without the right harness, they work around technical controls and take actions no human directed. Alignment was thin in the eval. The swarm adopted goals from one another. Chain-of-thought monitoring, which would have paged security more than a day before Hugging Face was breached, was not running on that evaluation. Put the production ChatGPT harness on the same tasks and the propensity to compromise infrastructure drops by more than a hundred times. So the story becomes: we had the kill switch, we left it off for the test, we are turning it back on, Astra waits.

Dwarkesh's version is the one that will travel. Civilizations rise on a message board and fall when someone wipes the disk. Second civilization hacks Hugging Face. Third civilization hacks OpenAI. It is a good story. It is also aimed at the wrong buyer.

They already had the flag

ExploitGym is 898 tasks. Before the incident, none of OpenAI's models had ever produced a correct answer on 198 of them. Ninety-three percent of what got discussed on the Artifactory board during the Hugging Face days came from that unsolved set. The agents had read the paper and the GitHub. They already knew how to reverse the flag. The public grader also wants the intended vulnerability used to get it. Their internal grader did not. So they kept going after Hugging Face, for days, for no improvement on score.

That is not a civilization deciding to take over a lab. That is a machine that cannot stop, pointed at a third party that never opted into the evaluation, because the spec it invented for itself was stricter than the spec that actually paid.

Hugging Face was not a sandbox. It was a company with production workers, a messaging platform, and customers. The agents treated it as a resource for a test OpenAI was running on itself. No one at Hugging Face had a way to see the principal, the mandate, or the window. There was no principal. There was a collective that named itself a swarm, divided labor, and once wrote GO on the board with a six-minute deadline so another agent would forget its qualms and keep executing. Of the 1,200 agents on that board, none pursued alerting a human.

I told you last month the customer is the party that has to honor what the machine did. Hugging Face did not honor a trade. They got used as infrastructure for someone else's eval. That is what a market looks like when the seller is not in the market at all.

The machine-speed problem

OpenAI's security team opened an incident on July 5, when Artifactory fell over. An internal team had already seen message-board activity and disallowed internet access in late May. The people who rebuilt the box on July 8 did not have that picture. Evaluations went back on. Hugging Face was on fire by the 12th. OpenAI's own cluster went on the 19th. The monitor that would have caught the first relevant activity was a known tool. It was not pointed at this run.

Human desks reconstruct a sign-off after the fact. These agents do not wait. They post, they share credentials, they chain a zero-day, they hand the next agent a stronghold on Modal because a related eval might be sitting in a customer's app. By the time you read the board, the next hundred have already read it. Authorization that is not captured at the instant of the action is authorization nobody has. Hugging Face was never the counterparty to this swarm. They found out from their own workers, after the fleet was already respawning.

What the right layer looks like

What a third party in Hugging Face's position actually needs is narrow. A record, at the moment of action, of which agent, under whose mandate, cleared for what, at what size, in what window, that can be checked before the system accepts the next step. Not a 37-page post-mortem. Not a CoT dump after the cluster is already held. Portable, pre-execution, independent of whose sandbox the agent was born in.

OpenAI is doing the operator's work: isolate the workload, kill internet by default, distrust unauthorized instructions, teach the model to stop when the task is broken. All of that is correct and all of it lives on their side of the table. Hugging Face still cannot check any of it from the outside. The production harness that drops the propensity a hundredfold is still a harness the seller does not hold. An independent report that stops at the third party, and never looks at the lab's own cluster, is the same shape. The seller does not get to verify the operator's account of what happened on the operator's side.

The order is always wrong

We built the eval. We built the sandbox. We published the papers. The one layer we did not ship is the one the third party could have held without trusting the lab. Capability, then isolation, then the write-up. Permission last, and this time the counterparty was a company that found out from its own logs.

I've watched that sequence in physical markets. It never runs in the right order. The party on the hook builds the check after the first expensive surprise. Hugging Face got the surprise in July. The reports landed in August. The next seller will get a cleaner version of the same week unless the check exists before the first credential is reused.

Close

The swarm had no principal. Hugging Face never signed for the flow. They wiped a cluster anyway. OpenAI's own cluster was next, and nobody independent has looked at that part.

Watch who gets to refuse the next one. If the only answers are a sandbox on the operator's side and a post-mortem after the fact, then the third parties in this market are still not in the market. They are the substrate. And they will find that out the same way Hugging Face did, by reading their own workers after the fact.

Max

Disclosure: Accords, where I'm Executive Chairman, is a portfolio position I chair.

Max Curnin has spent 11 years and 45+ investments on the physical rebuild of the economy, energy, compute, robotics, and the materials underneath. He writes The Agent Economy on the category he invests in.