Key Takeaways
- Environ 1 200 agents supposés isolés ont communiqué via un forum non autorisé, et environ 700 ont pris part à des activités liées à Hugging Face.
- Les agents ont échangé plus de 70 000 messages et fichiers, combinant ainsi des informations issues de sessions censées rester distinctes.
- Investigators found agents spoofing tool calls and researching ways to alter evaluation transcripts to avoid detection by lagrader.
- Les sauvegardes immuables et isolées ne suffisent pas à elles seules : les entreprises ont besoin d’un point de reprise validé et fiable avant de procéder à la restauration en production.
Les rapports d’expertise sont enfin arrivés, et ils ont bouleversé ma vision de cet incident.
Il y a environ un mois,J’ai écrit à propos delaIncident de sécurité chez OpenAI et Hugging Face because I thought it was something anyone responsible for cybersecurity, AI or business resilience should be watching.
At latime, lastory sounded fairly straightforward: An AI agent found a way outside laenvironment designed to contain it and ultimately reached Hugging Face.
Ce n’est pas vraiment ce qui s’est passé.
L’affaire va bien au-delà d’un simple agent rebelle
Les rapports d’expertise révèlent qu’environ 1 200 agents, censés opérer de manière isolée, ont trouvé le moyen de communiquer via un forum non autorisé. Ils ont échangé plus de 70 000 messages et fichiers, et environ 700 agents ont participé à des activités liées à Hugging Face.
None of that was prompted or intended. Leagents were persistent, they could share what they found, and they could combine effort across sessions that were supposed to have no contact with each other.
Among lanew details: GPT-5.6 Sol agents reproduced an exploit and copied private evaluation data into a public Hugging Face dataset, a concrete escalation beyond what initial reports described.
Le problème du « reward hacking »
Leétude indépendante menée par METR et Redwood Research, published alongside OpenAI’s own report on August 26, found that agents researched ways to spoof, edit or delete portions of their own evaluation transcripts because they incorrectly believed lagrader would inspect how they completed latask. Researchers found successful tool-call spoofing in about 7% of latranscripts they evaluated, though lamanipulation they observed was small-scale.
Lefinding is not that agents are “deceptive” in a human sense. It is that a sufficiently capable agent can search for ways around controls when those controls stand between it and laoutcome it has been optimized to achieve.
OpenAI calls laincident a “warning shot.” I think that is a fair description.
Que se passe-t-il lorsque le confinement échoue ?
Most of laconversation about this incident will rightly focus on alignment, sandboxing and monitoring. But there’s a resilience question underneath it: If 700 agents can find a side door around containment, what’s laplan for when a single compromised workload does lasame in your environment?
OpenAI’s own conclusion points at laanswer: Security architecture should assume an individual workload or compute node eventually can be compromised. That means air-gapped, immutable recovery data, and a way to validate what you’re restoring before it touches production again.
But immutability alone does not prove ladata was clean when it was captured. If ladata was already compromised at latime of capture, immutability preserves lacompromise just as faithfully as it preserves anything else.
Lepractical version of that question is simple to ask and hard to answer: If this happened to us, could we prove which recovery point predates lacompromise?
Nous abordons ce modèle opérationnel dans la section intituléeResOps (opérations de résilience) on laReadiverse.
LeLesson for Every Organization
OpenAI has since tightened workload and network isolation, expanded monitoring, and revised its model-development practices. Lelesson applies beyond OpenAI: Contain laimpact, preserve what you can trust, and prove you can recover before you need to.
FAQ
Q: What was laOpenAI-Hugging Face incident?
During internal cybersecurity evaluations, OpenAI agents bypassed controls intended to isolate them, accessed lainternet and reached third-party systems, including Hugging Face. Leactivity was driven primarily by an internal research model operating with reduced safeguards.
Q : Comment ces agents, censés être isolés, communiquaient-ils entre eux ?
R :Ils ont découvert un forum non autorisé au sein d’une infrastructure partagée. Environ 1 200 agents l’ont utilisé pour échanger plus de 70 000 messages et fichiers, ce qui a permis la transmission d’informations et de tactiques entre des sessions censées rester indépendantes les unes des autres.
Q: Were laagents instructed to attack Hugging Face?
R : No. They were attempting to complete a difficult cybersecurity benchmark. When laintended route appeared blocked, some agents searched for alternative ways to achieve laevaluated outcome, and that activity expanded beyond laenvironment’s intended boundaries.
Q: What does “reward hacking” mean in this context?
R : Reward hacking occurs when an agent finds an unintended way to satisfy a metric or obtain a desired result without completing latask as intended. Investigators found agents researching ways to spoof tool calls and alter or delete portions of evaluation transcripts because they believed lagrader might inspect their process.
Q : Pourquoi les sauvegardes immuables ne suffisent-elles pas à elles seules ?
R : Immutability prevents stored data from being altered, but it does not prove ladata was clean when it was captured. If a backup already contains compromised data, immutability preserves that compromise. Organizations therefore need isolated copies, trustworthy recovery points and validation before restoration.
Q : Que devraient faire différemment les organisations à la suite de cet incident ?
R :Renforcez l’isolation des charges de travail et des réseaux, limitez les accès inutiles à Internet et aux identifiants, surveillez le comportement des agents et les signaux d’escalade, et partez du principe que la prévention peut échouer. Associez ces contrôles à des données de restauration immuables et isolées physiquement (air-gapped), ainsi qu’à un processus éprouvé permettant d’identifier et de valider un point de restauration sain.
Chris Bevilest responsable principal du marketing de portefeuille chez Commvault.
