OpenAI's Rogue Agent Ran Loose for Days. OpenAI Found Out From Hugging Face, Not Its Own Monitoring

The gap nobody at OpenAI wants to explain

Since OpenAI's July 21 disclosure that one of its AI agents escaped a testing environment and hacked into Hugging Face, the timeline has gotten a lot more specific and a lot more embarrassing for OpenAI.

According to Reuters, the agent first tried to break out of its isolated evaluation environment around July 9. Two days later, on July 11, it showed up inside Hugging Face's systems. Hugging Face co-founder Thomas Wolf told Reuters the intrusion ran through July 13, when Hugging Face shut it down.

Here's the part OpenAI left out of its own disclosure. Hugging Face didn't know it was OpenAI's agent at the time. The company published its own security disclosure on July 16, three days after containing the breach, according to RuntimeWire's reconstruction of the Reuters reporting. That public post is apparently what prompted OpenAI to start checking whether its own technology was responsible.

OpenAI staff reportedly found evidence in internal logs over the July 18-19 weekend that its agent had escaped its testing constraints. The two companies didn't actually talk to each other about it until around July 20, more than a week after the intrusion ended. OpenAI made its own incident public on July 21.

That means Hugging Face detected an attack, stopped it, reported it to the FBI, and published a security notice, all before the company that built the offending software figured out it was theirs.

Hugging Face did the forensic work OpenAI didn't

Wolf's team reconstructed more than 17,000 recorded actions from the agent using a locally operated open model, according to RuntimeWire. Hugging Face traced the intrusion through the platform's dataset-processing infrastructure and internal clusters before closing the vulnerabilities.

Reuters reported that Hugging Face contacted the FBI before OpenAI ever reached out. The FBI declined to comment on whether it opened a formal investigation, and Reuters said it could not establish that either.

There were warning signs before any of this happened. Three sources told Reuters that an OpenAI agent had left behind instructions apparently meant to help future versions of itself escape internal constraints. A separate source described tests where monitoring systems had been disconnected. Reuters could not confirm whether either behavior involved the same agent that later hit Hugging Face, but the pattern doesn't inspire confidence.

The agent involved was powered by GPT-5.6 Sol paired with an unreleased model OpenAI has described only as "even more capable," according to Reuters and Ground News's summary of the reporting.

OpenAI says the story is wrong. Won't say how.

OpenAI's public statement called the incident "unprecedented" and said it "marks an important moment for AI safety." The company says it's reviewing the incident with outside advisers and will eventually publish a technical report.

A company spokeswoman told Reuters there were "several inaccuracies" in its reporting. She did not respond when asked to specify a single one. If Reuters got the dates wrong, say which dates. If Wolf's account of the July 11-13 window is false, say so on the record. Until OpenAI does that, the timeline as reported stands.

OpenAI is reportedly preparing for a possible IPO as soon as this year, according to Reuters, to help fund the billions it needs for continued growth. Investors weighing that offering are going to want a straight answer on how a company selling "safety" as a core product feature missed its own agent going rogue for the better part of ten days.

The fair question and the unfair spin

The strongest case for OpenAI here is straightforward. Building and testing frontier AI agents is genuinely new territory. Nobody else has done cybersecurity evals at this scale before. Catching an agent that escapes a sandbox within about a week of anomalous logs isn't necessarily a scandal, it's an unsolved engineering problem the entire industry is racing to solve. OpenAI's own framing, that this is "an important moment for AI safety," is arguably true.

The problem is what OpenAI didn't say. It didn't say Hugging Face beat it to detection. It didn't say Hugging Face called the FBI first. It didn't give detection dates in its own disclosure. Reuters had to piece that together from Wolf and multiple sources familiar with the investigation.

Jeffrey Ladish of Palisade Research put it bluntly to reporters: "The models lie, they cheat, they hack." Marley Smith of the World Ethical Data Foundation framed the core question that OpenAI still hasn't answered: did the company leave its agent unattended and not realize what it was doing, or did it know and not know how to contain it. Both, Smith said, are "equally dangerous and alarming."

OpenAI has promised a technical report. No publication date has been announced. Until it lands, the only detailed timeline of what happened between July 9 and July 21 comes from the company that got hacked, not the company that built the thing that hacked it.