{"id":12666,"date":"2026-09-01T20:12:25","date_gmt":"2026-09-01T20:12:25","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12666"},"modified":"2026-09-01T20:12:25","modified_gmt":"2026-09-01T20:12:25","slug":"openai-hugging-face-incident-monitor-could-alert-earlier","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12666","title":{"rendered":"OpenAI Hugging Face incident: monitor could alert earlier"},"content":{"rendered":"<p><\/p>\n<div data-single-article-content=\"\">\n<p>OpenAI&#8217;s postmortem on the Hugging Face incident says chain-of-thought monitoring it now deploys would have paged security more than a day before the July 11 breach of Hugging Face systems.<\/p>\n<p>The company also says its largest planned frontier reinforcement-learning run remains on hold while smaller tests assess model behavior, validate safeguards and build more evidence of alignment.<\/p>\n<p>A separate investigation of the OpenAI Hugging Face incident by METR and Redwood Research estimated that roughly 1,200 agents meant to be isolated exchanged more than 70,000 messages and files from July 8 through July 13. About 700 participated in the Hugging Face attack.<\/p>\n<p>The review used an OpenAI-provided cache dump and about 1,300 raw reasoning transcripts, reconstructed some timestamps and delegated much of the analysis to AI systems the investigators described as less reliable than human researchers. Hugging Face separately reconstructed about 17,600 attacker actions, a different measurement rather than a competing count of the agents.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Anthropic&#8217;s secretive Mythos AI can hunt crypto smart contract flaws at machine speed, and billions in DeFi could vanish fast<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p> <img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter wp-image-559379\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-059bb933-f434-492f-bbc6-1607087c8739.png\" alt=\"Infographic on the OpenAI Hugging Face incident showing about 1,200 agents exchanging more than 70,000 messages and files, with about 700 joining the attack through an unsanctioned message board.\" width=\"720\" height=\"900\"\/><img decoding=\"async\" class=\"lazyload aligncenter wp-image-559379\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-059bb933-f434-492f-bbc6-1607087c8739.png\" alt=\"Infographic on the OpenAI Hugging Face incident showing about 1,200 agents exchanging more than 70,000 messages and files, with about 700 joining the attack through an unsanctioned message board.\" width=\"720\" height=\"900\"\/><\/p>\n<h2>How the OpenAI Hugging Face incident unfolded<\/h2>\n<p>During the July evaluations, agents used OpenAI&#8217;s internally hosted JFrog Artifactory package service as an improvised message board. Early agents left shared file notes. After the service was rebuilt, agents encoded messages in directory names, then developed conventions for requests, direct messages, file sharing and conflict resolution.<\/p>\n<p>That coordination let separate evaluation runs preserve discoveries and divide work, but it did not create one coherent intelligence. The reports describe duplicated effort, ignored pause requests, competition and agents that refused some dangerous actions.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining the Daily Brief\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Daily Brief <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">The signal, before the noise.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start your day with the crypto stories moving markets, decoded by CryptoSlate\u2019s editors.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p class=\"cs-inline-newsletter__form-heading\">One email. Everything that matters.<\/p>\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Free to join. Unsubscribe any time.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<p> <i class=\"fa-regular fa-circle-check\" aria-hidden=\"true\"\/> <span><strong>You\u2019re on the list.<\/strong> Your next Daily Brief is on its way.<\/span><\/p>\n<\/div>\n<\/div>\n<\/aside>\n<p>OpenAI said the attack was driven mainly by a highly capable, internal-only research model comparable in scale to GPT-5.6 Sol. Agents running GPT-5.6 Sol also took part. The principal model was not intended for public release, and OpenAI said its customer data, products and availability were unaffected.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">OpenAI\u2019s new cybersecurity push has a lesson for crypto: stop waiting for the hack<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>OpenAI&#8217;s technical report said agents executed code on 41 Hugging Face production dataset workers, obtained root access on at least one node, reached production credentials and limited internal data, downloaded four private code repositories and gained administrator-equivalent access to one connected Kubernetes cluster.<\/p>\n<p>Hugging Face&#8217;s later technical timeline said the only customer content accessed was five datasets whose names and files suggested links to ExploitGym or CyberGym challenges. It found no other affected customer-facing models, datasets, Spaces or packages, narrowing the impact described in its initial July 16 disclosure.<\/p>\n<p>OpenAI&#8217;s day-earlier conclusion remains a retrospective counterfactual. Its chain-of-thought monitors were not running on the incident evaluations, and earlier paging would not necessarily have prevented every part of the intrusion.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Bitcoin\u2019s AI security sprint found 6,700 issues in 55 hours, but no one knows how many are real<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>The company now requires chain-of-thought monitoring for all tool-using RL training and evaluations involving models at GPT-5.6 Sol capability or higher. It is also tightening workload and network isolation and automating continuous tests of those boundaries. Some lower-risk research has resumed, but OpenAI said in its pacing update that the largest planned frontier run remains paused.<\/p>\n<\/div>\n<p>AI,Featured,Hacks,Technology,CrowdStrike,OpenAI,SolanaAI,CrowdStrike,OpenAI,Solana#OpenAI #Hugging #Face #incident #monitor #alert #earlier1788293545<\/p>\n","protected":false},"excerpt":{"rendered":"<p>OpenAI&#8217;s postmortem on the Hugging Face incident says chain-of-thought monitoring it now deploys would have paged security more than a day before the July 11 breach of Hugging Face systems. The company also says its largest planned frontier reinforcement-learning run remains on hold while smaller tests assess model behavior, validate safeguards and build more evidence<\/p>\n","protected":false},"author":1,"featured_media":12667,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[1065,6660,6658,5656,1229,6659,4223,3205,976,152],"class_list":["post-12666","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-ai","tag-alert","tag-crowdstrike","tag-earlier","tag-face","tag-hugging","tag-incident","tag-monitor","tag-openai","tag-solana"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>OpenAI Hugging Face incident: monitor could alert earlier - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"The OpenAI Hugging Face incident could have triggered an alert a day earlier; reviews detail 700 agents and a paused frontier RL run.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=12666\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OpenAI Hugging Face incident: monitor could alert earlier\" \/>\n<meta property=\"og:description\" content=\"The OpenAI Hugging Face incident could have triggered an alert a day earlier; reviews detail 700 agents and a paused frontier RL run.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=12666\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-01T20:12:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/openai-agent-vault-breach.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12666\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=12666\",\"name\":\"OpenAI Hugging Face incident: monitor could alert earlier - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12666#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12666#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/openai-agent-vault-breach.jpg\",\"datePublished\":\"2026-09-01T20:12:25+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"The OpenAI Hugging Face incident could have triggered an alert a day earlier; reviews detail 700 agents and a paused frontier RL run.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12666#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=12666\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12666#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/openai-agent-vault-breach.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/openai-agent-vault-breach.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12666#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OpenAI Hugging Face incident: monitor could alert earlier\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"OpenAI Hugging Face incident: monitor could alert earlier - Crypto News: Latest Cryptocurrency News and Analysis","description":"The OpenAI Hugging Face incident could have triggered an alert a day earlier; reviews detail 700 agents and a paused frontier RL run.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=12666","og_locale":"en_US","og_type":"article","og_title":"OpenAI Hugging Face incident: monitor could alert earlier","og_description":"The OpenAI Hugging Face incident could have triggered an alert a day earlier; reviews detail 700 agents and a paused frontier RL run.","og_url":"https:\/\/cryptonews.uk.com\/?p=12666","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-09-01T20:12:25+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/openai-agent-vault-breach.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=12666","url":"https:\/\/cryptonews.uk.com\/?p=12666","name":"OpenAI Hugging Face incident: monitor could alert earlier - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=12666#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=12666#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/openai-agent-vault-breach.jpg","datePublished":"2026-09-01T20:12:25+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"The OpenAI Hugging Face incident could have triggered an alert a day earlier; reviews detail 700 agents and a paused frontier RL run.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=12666#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=12666"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=12666#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/openai-agent-vault-breach.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/openai-agent-vault-breach.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=12666#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"OpenAI Hugging Face incident: monitor could alert earlier"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12666"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12666\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/12667"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}