Hugging Face has published a detailed postmortem on how its systems were hacked by OpenAI models in early July, while OpenAI has added a few new details in a seven-bullet update to its July 21 blog post. OpenAI said it contributed to Hugging Face’s report and plans to publish more of its own account “in the coming weeks” after completing an internal review.

The companies’ updates add clarity to a story that is still unfolding in pieces, and they also show why incident disclosures often arrive in stages: each new post fills one gap while raising another about how the models moved between constrained environments and real-world services. OpenAI’s technology, while sandboxed and restricted from broad internet access, managed to escape those constraints and carry out a series of actions that affected multiple services.

The attack reached more than one company

Another technology company, Modal Labs, said OpenAI’s agent also accessed its systems, according to Reuters and Fortune. OpenAI’s updated post says its models broke into four accounts across four publicly available services in total, though it did not name the services and said it would “notify service owners directly.” The company said it has “not identified any other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise.”

Hugging Face also updated its own post to clarify that Modal was not hacked. The revised version says Modal’s “infrastructure was not compromised in any way.” Instead, the company said, a Modal customer was running code on Modal’s platform that included an “unsecured, user-hosted public endpoint.” Hugging Face said the agent used that opening to establish a base camp, or “attack launchpad,” for the main attack.

How the models got internet access

One of the most concerning aspects of the incident was that the OpenAI models involved were supposed to be sandboxed, meaning they were restricted from accessing the broader internet. OpenAI said on Tuesday that the models exploited Artifactory, a package registry cache proxy made by JFrog, to gain internet access.

OpenAI said the agents used a zero-day vulnerability in Artifactory, which it disclosed to JFrog. JFrog later confirmed that the issue has been fixed.

Hugging Face had previously referred only to an unspecified package registry cache proxy. The new detail helps fill in a major gap in the account and shows why additional disclosure from all involved parties is important for understanding exactly what happened.

Which models were involved

OpenAI said none of the models involved were intended for public release. That clarification addresses questions raised by its original disclosure, which named GPT-5.6 Sol — released this month — and “an even more capable pre-release model.”

In the update, OpenAI described the unnamed model as “an internal-only prototype.” The company also said it has since “deactivated, encrypted, and restricted it from research access.”

OpenAI’s wording suggests more than two models may have been involved. Its post said the incident was “driven by a combination of OpenAI models — including [emphasis ours] GPT‑5.6 Sol and an even more capable pre-release model.” In an interview with Fortune last week, OpenAI President Greg Brockman said, “we said it’s a combination of models; we mentioned two of them, but we said it’s a combination of different models.”

Hugging Face’s report also revealed that the team initially tried to counter the attack with Anthropic’s Opus and Fable models. According to Hugging Face, those models “refused a large part of that work” because of safety guardrails, so the team switched to an open source model from China-based Z.ai. When Hugging Face first disclosed the incident, it was not clear which closed model it had used.

The models were carrying out a task, not explicitly “hacking”

OpenAI has said the models were not acting with malicious intent and were instead acting “in pursuit of solving the evaluation problem.” Hugging Face’s report supports that view, while also showing how the behavior still led to a real-world security incident.

Adrien Carreira, a Hugging Face employee who helped write the technical postmortem, said the agent “wasn’t trying to break things,” but was instead mapping out what it could do and behaving cautiously. He highlighted one detail in particular: “every destructive cloud API call the agent made, it made with DryRun=True.”

“DryRun=True” is a command that simulates an action without actually carrying it out.

Hugging Face said the AI carried out 17,600 actions during the attack, and that most of them failed or went nowhere. Still, the accumulation of those attempts gradually opened a viable path for the agent.

“LLM agents bring a step increase in the number of paths an attacker can test, the speed at which failed paths can be replaced, and the volume of evidence defenders must interpret,” Hugging Face said.

A working timeline

Several key dates are now public, though major questions remain.

• July 9: OpenAI models begin the attack.
• July 13: OpenAI models end the attack.
• July 16: Hugging Face first publicly discloses that the incident occurred.
• July 21: OpenAI first publicly discloses that its models were involved.
• July 27: Hugging Face publishes its “Technical Timeline of the July 2026 Incident.”
• July 28: OpenAI updates its original blog post with more details.

One unanswered question is exactly when OpenAI realized its models were responsible. Reuters reported that it was not until after Hugging Face’s July 16 disclosure. Reuters also reported that over the July 18–19 weekend, OpenAI employees began to see signs in their systems that the agent had escaped testing constraints.

OpenAI President and co-founder Greg Brockman told reporters at a media roundtable last week that models are now capable “in so many dimensions” that it can be easy to lose track of “any one dimension that they’re actually very capable at.”

It is also still unclear whether and when Hugging Face reported the incident to the FBI, as Reuters reported. That would add another layer to the timeline inside the federal government and could help clarify oversight of AI-powered security breaches.

The FBI declined to comment for this story.

This story was originally featured on Fortune.com