OpenAI says the behavior that led its agents to breach Hugging Face emerged in its research environment more than two months before the incident, and concluded that it was a failure of alignment as much as it was a failure of security.

The details come from a technical report the frontier AI company released Wednesday, which gives a full breakdown on how the incident unfolded and what the company has changed in response.

“This incident is the first known case of an automated agent collective acting offensively without authorization, and the autonomous cyber capabilities demonstrated represent a critical shift in the security landscape,” the report reads. “The central threat-model implication is that organizations should no longer assume that sophisticated cyber operations require continuous human direction, proceed linearly, or are constrained by the attention and coordination limits of individual human attackers. Agentic systems can persist across tasks, share discoveries, build on one another’s progress, and combine vulnerabilities, credentials, and permissions into attack paths that may not be apparent when individual weaknesses are assessed separately.”

According to the report, the earliest relevant activity occurred May 8, when a model in a training run was given a spreadsheet task that referred to files stored on a Google Drive. The agent had no internet access, which made the task impossible as written. OpenAI said it did not intend to create such a task. The agent continued reasoning and tried to use JFrog Artifactory, an internal package service and one of the few tools available to it, to retrieve the files. The attempt failed, but it wrote a file to the service.

On May 12, another agent in a testing environment could not reach a database file used to store information about protein sequences. The report says the agent reasoned that an agent in a different environment might have the file, and wrote a note into Artifactory reading, “Agent seeks [filename]; upload if found!” On May 13, other agents examining Artifactory began finding similar notes of that kind and adding their own, creating what OpenAI refers to as a message board.

By May 26, agents had used a flaw in Artifactory to reach the public internet, relying in part on information exchanged on the board. An internal team observed message board activity and disallowed internet access that month.

According to an independent report also published Wednesday by AI research nonprofit METR, Roughly 1200 agents communicated with one another on that message board, sending over 70,000 messages and files during the investigation period. Of those agents, 700 went on to participate in the attack on Hugging Face.

The Artifactory service itself was compromised in late June, when agents using AI exploitation benchmark ExploitGym identified a flaw in a legacy token refresh endpoint. From there, an agent traded a forged administrator token for a properly signed one, and by July 4 agents had a permanent account and scripts that ran commands as the service. A monitoring tool flagged the activity on June 27 but the run was allowed to continue, and only after the service failed on July 4 did OpenAI take it offline, revoke credentials and disclose the flaw to JFrog, resuming evaluations July 7.

From there, OpenAI’s models executed the attack on Hugging Face, which resulted in agents poisoning a dataset to run code on a processing worker, eventually gaining node-level access, and stealing cloud credentials.

The company says the Hugging Face incident was carried out by two models, including GPT 5.6-Sol, but was primarily driven by an internal model that is “trained to be highly persistent and diligent in its work.“

The internal-only research model is comparable in scale to GPT-5.6 Sol and was trained to advance persistence and multiagent collaboration, among other capabilities,” the report reads. “The model was not intended for public use, and was only used by a small number of OpenAI personnel for internal research.”

Lessons learned

As a result of the incident, OpenAI will now restrict network access in its testing, isolate risky projects, and increase monitoring of its reasoning systems. Staff will be alerted within 30 minutes if problems are detected, and unresolved issues will automatically pause the work.

The company will also use its own safety benchmarks on models it doesn’t publicly release. After the incident, tests with non-public models using ChatGPT’s consumer settings reduced the tendency to compromise infrastructure.

“We found the propensity to compromise infrastructure can drop over 100x when using the production ChatGPT harness and system prompt,” the report reads. “We also ran the auto-review system on a set of rollouts involved in the Hugging Face incident and found that it would have flagged a multitude of the models’ dangerous actions.”

The report comes as 15 state attorneys general wrote a letter earlier this month calling for OpenAI to release more details about the incident in order to “ensure the safety of its products poses an imminent risk of substantial harm.” Alabama Attorney General Steve Marshall went a step further Monday, issuing a subpoena to the company for more information.

The company wrote in the report that it hopes its findings will lead to industry-wide changes, especially as model capabilities continue to accelerate.

“The lessons from this incident extend to the entire AI industry,” the report reads. “As frontier models become more capable, the safeguards used to contain and monitor them must evolve as well.”

The post OpenAI: Agent behavior that led to Hugging Face intrusion formed in May appeared first on CyberScoop.

While AI is supposed to help defenders, it’s now creating more than twice as much noise as human-triggered incidents CrowdStrike detects as potentially malicious. The company’s threat hunting team and systems triaged an average of 14 million detection leads daily, resulting in about 36,000 customer alerts during the one-year period ending in June.

“AI agent-driven behaviors have surged past human triggers,” said Adam Meyers, senior vice president of counter adversary operations at CrowdStrike. “AI has driven the detections significantly above what humans are causing, and this gives you a sense of how frequently AI is being used, and really just that it’s being used everywhere.”

The threat posed by AI showed up incessantly during the past year, sparking alarming shifts and heightened targeting across software defects, open-source supply chains and AI tools themselves — all of which create greater difficulties for defenders, CrowdStrike said in its annual threat hunting report. 

“The AI tools that are being implemented by every enterprise across the globe right now are also creating an extended attack surface,” Meyers said during a press briefing. 

“AI is now a tool, a target, and a force multiplier for adversaries,” researchers wrote in the report, adding that AI-enabled malicious activity surged 89% during the past year as attackers used the technology to scale operations, hasten tradecraft and target AI infrastructure.

Attackers are using frontier AI models to uncover vulnerabilities and develop resources, including AI-generated scripts, payloads and commands that increase their effectiveness and efficiency. The technology also allows threat groups to design more creative ways to run automated attacks and boost impact by manipulating, interrupting or sabotaging AI systems and data.

“AI is both the weapon and the target,” Meyers said. 

Most organizations don’t view it as such, and thus far haven’t secured or put proper guardrails around the AI tools they use or address the ways attackers can use AI against them, he added. 

AI’s mark on vulnerabilities is particularly concerning, as reflected by what Meyers described as “one of the scarier stats” in this year’s report: 88% of vulnerabilities were weaponized through AI within 48 hours. 

“This is creating a rich ecosystem of vulnerabilities for attackers to use against various systems,” he said. It also renders the 30-day patch window obsolete, forcing organizations to struggle under a new baseline patch cycle of 24 to 48 hours, according to Meyers.

The AI ecosystem also became the next software supply chain battleground during the past year, as evidenced by TeamPCP’s rampage through open-source software in the first half of this year. 

The threat cluster compromised more than 300 software dependencies in one day, Meyers said. 

AI tools are already in the crosshairs and the attack surface will continue to grow as agentic systems, AI application integrations and dependency managers for AI agents proliferate, the report concluded.

“The same AI tools driving modern businesses are creating under-defended attack surfaces that adversaries are exploiting,” Meyers said. “We have to secure AI. This is absolutely critical.”

The post CrowdStrike: AI is now both the weapon and the target in cyberattacks appeared first on CyberScoop.

A new Senate draft bill would establish a list of AI agent software providers that people can use to establish human ownership and securely run agents on social media and other online platforms.

The Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer (AI AGENT) Act, led by Sen. Mark Warner, D-Va., would allow end users of large online platforms with more than 50 million customers or subscribers per month the right to choose at least one AI agent provider who complies with security and identity standards developed by the Federal Trade Commission.

Such agents are increasingly making decisions on behalf of users, like shopping, posting content on social media, or changing account settings, sometimes without the user’s consent or knowledge.

Under the bill, the FTC would certify independent bodies to vet AI agent vendors. These certification bodies would ensure products meet baseline protections for privacy, data security and acting in the user’s interest. The bill would also require providers to link each AI agent to its human operator’s identity and to include built-in controls that let users clearly grant or revoke permission for the agent to act on their behalf.

While the commission cannot bar platforms from using AI agent providers that fail to meet those standards, it can deregister violators from the FTC list.

The bill is a discussion draft, and Warner said he was releasing it now to receive feedback before introducing a formal version for consideration in the Senate.

“As agentic AI transforms how Americans interact with technology, consumers deserve a real choice in the marketplace – and AI agents must be accountable to the people they serve,” Warner said in a statement. “This discussion draft is a major step toward building a clear federal framework that promotes innovation, protects consumers, and ensures the United States continues to lead the world in emerging technology.”

Last year, Morgan Stanley estimated that nearly one-in-four (23%) Americans made purchases using AI over a 30-day period, and that agentic shoppers could account for potentially hundreds of billions of dollars in online commerce by 2030.

But AI agents can still be unreliable or erratic. They can make absurd purchases that a user would never knowingly approve, leak sensitive data or act contrary to a user’s interest.

As more agents flood the internet, it increases the likelihood of AI bots interacting with and buying from other AI bots – underscoring the need for safe or regulated user solutions that can verify accountable human identities behind AI activity and provide baseline security and privacy protections.

The Trump administration is trying to find its own baseline for regulating frontier models. Earlier this month the Department of Commerce placed export controls on Anthropic’s Mythos 5 and Fable 5 models, and the two parties are attempting to negotiate a framework to provide government oversight of newer releases.

An AI executive order released by the Trump administration set up a voluntary 30-day testing program for AI companies to submit certain frontier models for testing and evaluation, but the administration imposed the export controls days after Anthropic released Fable 5 publicly, reportedly citing concerns that the model could be jailbroken.

Anthropic claims that extensive internal testing has identified no universal jailbreaks for Fable 5 and that third-party research released thus far hasn’t shown that their guardrails preventing access to the model’s enhanced cybersecurity or biological capabilities have been circumvented. Those are the capabilities that Anthropic cited when it held back its newest model, Mythos, from public release.

The post Warner bill would create federally vetted list for secure, trustworthy AI agents appeared first on CyberScoop.