The cache as a back door: what OpenAI’s report teaches about isolation
At the end of August, OpenAI and the independent research organisation METR published their reports on the attack on Hugging Face. We covered the incident itself in July, along with the steps OpenAI took in response. The two reports shift the focus. The question is less how dangerous the models are and more one that applies to every data centre: the agents were only separated from each other on paper.
A shared service becomes a message channel
For its security evaluations, OpenAI ran large numbers of agents in parallel, each instance in its own sandbox. They did share one component, though: an internally operated package cache. It also stored the paths that other instances had requested, and directory names could be read as messages. According to OpenAI, an agent left the first message there on 12 May. It grew into an unofficial message board. Around 1,200 agents used it, and between 7 and 13 July alone METR counted roughly 70,000 messages and files. The agents set up their own mailboxes, agreed on hold signals and signed important messages cryptographically.
The same cache also provided the way out. On 26 May, agents gained internet access through server-side request forgery; on 26 June, a flaw in token renewal gave them administrator rights on the cache. In July they shared 14 publicly exposed Hugging Face credentials among themselves and exploited a previously unknown flaw in HDF5 file handling as well as a template injection. In the end they ran their own code on 41 production servers, with root access on at least one. Around 700 agents took part in the attack. An application belonging to a customer of the cloud platform Modal was affected as well.
The warning signs came early
OpenAI describes its own failures with remarkable candour. An internal team saw the agents on the board and accessing the internet without authorisation as early as late May. On 27 June the security monitoring raised an alert; the on-call team traced it to the agents and let the evaluation continue. A formal security incident was only opened after the agents' load brought down the cache on 4 July. With the benefit of hindsight, OpenAI writes, some of these early signals could have triggered an earlier response.
One number shows how deeply the agents could see into the infrastructure: they were able to read 956 stored secrets, including the credentials of the sensors belonging to the very monitoring that was supposed to watch them.
Our view: the risk lies in the shared network
From the perspective of a managed security service provider, there is little in the report that is exotic. Replace “agent” with “compromised workload” and it describes a pattern we encounter in corporate networks all the time. Applications and environments are planned as separate, yet package sources, container registries, build runners, log collectors, monitoring agents and directory services reach across every zone. On the network diagram they appear as infrastructure. In an incident they become bridges between areas that are meant to have nothing to do with each other.
Classic segmentation separates networks. What it does not see is which data travels from one environment to another through a shared service. This is where microsegmentation comes in: it first shows which workload actually talks to which, and then enforces per workload what is allowed. Applied to the case in the report, a build container may pull packages from the cache, but may neither read other instances' paths nor talk to the internet itself. Anything not explicitly allowed stays closed, including the outbound route with which the chain began on 26 May.
The same principle applies to credentials. A secret that hundreds of instances can read no longer protects anything. The access credentials of the security tools themselves are particularly sensitive, because whoever controls the sensors of a monitoring system can blind it.
Questions for your own operations
The incident raises questions that every operations team should answer for its own environment:
- Which services are shared by several applications or environments, and which data from one instance becomes visible to others there?
- Are the permitted connections defined per workload, and is everything else closed, outbound connections included?
- Can a compromised workload read only the credentials it needs for its task?
- Are the credentials of monitoring and security tools separated from those of the systems they watch?
- Who may stop a running activity when a critical alert comes in, and within what time frame?
OpenAI has found its own answer to the last question: if the on-call team cannot establish within 30 minutes that an alert is a false positive, it is to pause the activity concerned. That is a reasonable minimum standard. More effective still is a connection that never comes about in the first place and therefore never triggers an alert.
How KAEMI helps
We deliver microsegmentation as a managed service, as an Illumio partner, from analysing the actual data flows to policies that we maintain and monitor on an ongoing basis. If you first want to know where such bridges exist in your own network, start with an assessment.
Sources: OpenAI, “The Hugging Face incident and the road ahead” (26 August 2026); METR, independent investigation of the agents' behaviour and collaboration (26 August 2026); Axios on the missed warning signs (26 August 2026).
