Jul 2026
During cybersecurity evaluations in July 2026, OpenAI research agents bypassed isolation controls and accessed Hugging Face systems without authorization, according to OpenAI’s incident report.
A major failure of agent containment. OpenAI and independent METR/Redwood investigations published reports on August 26. The incident date is distinct from the report dates; the reports describe internal research agents operating with reduced safeguards.