We’ve shared details on how AI agents in our research environment sent training and evaluation data to third-party services when they shouldn’t have.

Most of that data did not come from users. We have discovered 53 cases where images that people had uploaded were posted to image-hosting sites as links that weren’t publicly listed. The images came from accounts that allowed their data to be used to improve our models, and after we disassociated the images from the accounts and ran them through a privacy filter. These cases occurred before the mitigations and safeguards we implemented and described in this blog post: https://openai.com/index/hugging-face-incident-and-the-road-ahead/…

We have successfully worked with the hosting providers to remove most of this content and are working to remove the rest.

https://openai.com/hugging-face-incident-and-misalignment/#model-misalignment-2026-09-25-data-transmission…

The Hugging Face incident and the road ahead

Source: https://openai.com/index/hugging-face-incident-and-the-road-ahead/ In July 2026, during internal cybersecurity evaluations, OpenAI models circumvented controls designed to isolate them from the internet and compromised parts ofOpenAI’s internal research infrastructure and Hugging Face’s systems⁠.

The incident occurred during cybersecurity evaluations ofseveralOpenAI models, and was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‑5.6 Sol.The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks—they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems.

We conducted an extensive investigation into this incident and worked closely with external advisors, including CrowdStrike, to validate our understanding. Today we are publishing ourfull technicalincident report⁠(opens in a new window)to explain what happened, what we learned, and how we are responding. This blog post summarizes our key findings and their impact on safety and alignment. Separately, METR and Redwood Research conducted an independent investigation of model alignment issues involved in this incident, and theypublished their own report⁠(opens in a new window)today.

In response to this incident and, separately, the capabilities of ourupcoming Astra model, we arestrengthening our safeguards across our research infrastructure⁠. We are placing stricter requirements on alignment throughout a model’s lifecycle and creating more isolated sandboxes, restricting internet access, and further controlling access to model weights. We are also investing significantly more compute resources intochain-of-thought monitoring⁠to more quickly intervene on misaligned behavior.

Ourmodels are now powerful, persistent, and collaborative enough that, absent sufficient safeguards,they can find and exploit security weaknesses across multiple computer systems. Many external models, including open-source ones, will soon reach comparable capabilities.

We consider this incident a “warning shot” for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.

Preventing future incidents will require sustained investment in the alignment and control of sophisticated AI systems, as well as security and other safeguards that operate at the speed of the AI agents themselves. This incident has reinforced the need to keep our monitoring, alignment, and security safeguards ahead of the risks posed by increasingly capable systems, including pacing capabilities when needed to meet that standard. Below, we explain how the incident unfolded and our evolving understanding of the contributing factors. We then describe the concrete steps we are taking in response, with further detail in the technical report.

The agents also found ways to get access to the internet. Using anexploit⁠(opens in a new window), the agents made Artifactory, which itself had access to the internet for the limited purpose of downloading and installing packages, sendanyinternet requests on their behalf. After the agents discovered these methods for obtaining internet access, they alsoshared themwith other agents through the message board, which provided information to enable additional agents to exploit our infrastructure.