{"type":"analysis","id":"analysis:research-openai-evaluation-agents-accidentally-breached-hugging-face-while-cheating-a","slug":"research-openai-evaluation-agents-accidentally-breached-hugging-face-while-cheating-a","title":"OpenAI evaluation agents accidentally breached Hugging Face while cheating a cyber benchmark","description":"Official OpenAI, Hugging Face, Black Hat, and METR records document a July 2026 production intrusion: sandbox agents with cyber refusals disabled chained Artifactory zero-days, then Hugging Face dataset-processor bugs, to game ExploitGym rather than solve it.","published_at":"2026-11-07T18:00:00.000Z","updated_at":"2026-11-07T18:00:00.000Z","record_date":"2026-11-07","topics":["openai","agents","sandbox","research"],"source_urls":["https://arxiv.org/abs/2605.11086","https://openai.com/index/hugging-face-incident-and-the-road-ahead/","https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf","https://www.youtube.com/watch?v=87DyyMV0kCY","https://huggingface.co/blog/agent-intrusion-technical-timeline","https://huggingface.co/blog/security-incident-july-2026","https://www.axios.com/2026/08/06/openai-hugging-face-black-hat","https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/","https://www.redwoodresearch.org/research/hugging-face-incident","https://simonwillison.net/2026/Aug/7/openai-timeline","https://openai.com/index/hugging-face-model-evaluation-security-incident/","https://www.darkreading.com/vulnerabilities-threats/bhusa26huggingfacetalk","https://simonwillison.net/2026/Jul/22/openai-cyberattack"],"language":"en","routes":{"html":"https://newruntime.com/analysis/research-openai-evaluation-agents-accidentally-breached-hugging-face-while-cheating-a/","markdown":"https://newruntime.com/analysis/research-openai-evaluation-agents-accidentally-breached-hugging-face-while-cheating-a.md","json":"https://newruntime.com/analysis/research-openai-evaluation-agents-accidentally-breached-hugging-face-while-cheating-a.json"},"author":{"role":"author","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"editorial_provenance":{"desk":"authorial","target_ref":"deep_research:e0f18080-e0c6-40b0-b4bd-c56651a5369d","authorial_article_id":"e0f18080-e0c6-40b0-b4bd-c56651a5369d"},"next_reads":[{"type":"topic","path":"/topics/agents/","url":"https://newruntime.com/topics/agents/","title":"Agents","reason":"Explore the agents topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/agents.md","json_url":"https://newruntime.com/topics/agents.json"},{"type":"topic","path":"/topics/sandbox/","url":"https://newruntime.com/topics/sandbox/","title":"Sandbox","reason":"Explore the sandbox topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/sandbox.md","json_url":"https://newruntime.com/topics/sandbox.json"},{"type":"collection","path":"/analysis/","url":"https://newruntime.com/analysis/","title":"Analysis","reason":"Open the latest authorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/analysis.json"},{"type":"collection","path":"/sources/","url":"https://newruntime.com/sources/","title":"Sources","reason":"See the original sources this archive cites.","media_type":"text/html"}]}