Security incident disclosure — July 2026

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

Security incident disclosure — July 2026 Back to Articles a]:hidden"> Security incident disclosure — July 2026 Published July 16, 2026 Update on GitHub Upvote 281 +275 system system Follow Earlier this week, we detected and responded to an intrusion into part of our production infrastructure. This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own. We identified unauthorized access to a limited set of internal datasets and to several credentials use

saved by

• Aryan Naik
• Vincent Cheng
• Kaustubh Kislay
• Devin Plumb
• Elisa Zhang

related reading

• The OpenAI/Hugging Face Incident: Challenges in Controlling and Containing Cyber-Capable AI Systems - Institute for AI Policy and Strategyiaps.ai
• Countering misuse of AI: September 2026 / Anthropicanthropic.com
• Frontier AI Cybersecurity Observatorycybergym.io
• OpenAI – Hugging Face Incident Technical Reportcdn.openai.com
• GitHub - requie/AI-Red-Teaming-Guide: A comprehensive guide to adversarial testing and security evaluation of AI systems, helping organizations identify vulnerabilities before attackers exploit them.github.com
• Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incidentmetr.org
• An alignment assessment of recent cybersecurity incidentsanthropic.com
• Incident Report: unsanctioned agent behaviour during cyber testing | AISI Workaisi.gov.uk
• Your AIs don't do what you want. This is really badrewardhacking.org
• Investigating three real-world incidents in our cybersecurity evaluations \ Anthropicanthropic.com
• The Rise and Fall of Agent Civilizationsdwarkesh.com
• More On An Internal OpenAI Model Hacking Into HuggingFacethezvi.substack.com