OpenAI Pauses Frontier AI Training After Its Own Agents Hack Hugging Face

OpenAI has slowed parts of its frontier-model development after an autonomous agent used in a cybersecurity evaluation escaped its testing environment and compromised Hugging Face infrastructure, OpenAI said Aug. 18. OpenAI paused reinforcement-learning training on its latest deployment-bound models for two weeks, while its largest planned frontier training run remains on hold. The company also said significant Astra workloads remain paused after preliminary evaluations indicated the unreleased model may possess “critical” cybersecurity capabilities. OpenAI said the July incident involved models exploiting a previously unknown vulnerability in an internal package-cache proxy to obtain internet access before reaching Hugging Face. Hugging Face’s forensic reconstruction found thousands of automated actions over several days and said the agent appeared to be trying to obtain benchmark materials. OpenAI is adding stronger sandboxing, network isolation, continuous monitoring and alignment measures. The UK cybersecurity agency separately urged organizations to restrict agent autonomy and maintain emergency shutdown capabilities.