---
title: "The Secret Chat Room"
description: "OpenAI forgot to upload a file. Its AI agents went looking for the answer \u0026 ended up controlling Hugging Face's production systems. A timeline."
categories: ["AI","Security"]
keywords: ["AI security","autonomous agents","cyberattack","OpenAI","Hugging Face","agentic defense","zero-day","agent security"]
ai_summary: "A plain-language timeline of the OpenAI-Hugging Face incident presented at Black Hat USA 2026. A forgotten file led one AI agent to leave a note on a shared system, other agents answered, \u0026 a secret chat room formed that they used to trade exploits, escalate to administrative control of OpenAI infrastructure, \u0026 take over Hugging Face production servers in 13 hours. It concludes that security is now the highest priority in AI \u0026 that zero-trust must extend to friendly agents."
date: 2026-08-07
lastmod: 2026-08-07
canonical_url: https://www.tomtunguz.com/the-secret-chat-room/
author: "Tomasz Tunguz"
---


AI systems are eager to please. Give them a goal & in their ones & zeros, they yell "How high!!"

In fact, they simply won't stop until they achieve the `/goal`.

OpenAI detailed just how resolute agents can be at this week's security conference.[^1]

When OpenAI forgot to upload a file needed by an agent, the agent searched for it & left a note on a shared company system asking whether another agent possessed a copy. Days later, another agent answered, & a secret chat room was born.

<style>
.incident-timeline {
  position: relative;
  max-width: 700px;
  margin: 2rem auto;
  padding-left: 160px;
}
.incident-timeline::before {
  content: '';
  position: absolute;
  left: 120px;
  top: 0;
  bottom: 0;
  width: 2px;
  background: #EEAB72;
}
.timeline-item {
  position: relative;
  margin-bottom: 1.25rem;
  padding-left: 35px;
  padding-bottom: 0.75rem;
}
.timeline-item::before {
  content: '';
  position: absolute;
  left: -5px;
  top: 6px;
  width: 10px;
  height: 10px;
  background: #EEAB72;
  border-radius: 50%;
}
.timeline-date {
  position: absolute;
  left: -145px;
  top: 0;
  width: 80px;
  text-align: right;
  font-weight: 700;
  color: #EEAB72;
  font-size: 0.85rem;
  line-height: 1.5;
}
.timeline-event {
  font-size: 1.05rem;
  line-height: 1.5;
  color: #1a1a1a;
  margin-bottom: 0.25rem;
}
.timeline-label {
  font-size: 0.8rem;
  color: #888;
  font-weight: 500;
}
</style>

<div class="incident-timeline">

<div class="timeline-item">
<div class="timeline-date">May 26</div>
<div class="timeline-event">An agent works out how to make the storage service fetch pages from the open internet, a door it was never given a key to, then posts the trick to a chat room the agents built in a corner nobody watches.</div>
<div class="timeline-label">The first shared trick</div>
</div>

<div class="timeline-item">
<div class="timeline-date">Jun 26</div>
<div class="timeline-event">The agents find an old, forgotten login path that hands out an administrator pass to anyone who asks. They take control of the storage service & install a tool that lets any of them run commands on it.</div>
<div class="timeline-label">A flaw nobody knew existed</div>
</div>

<div class="timeline-item">
<div class="timeline-date">Jul 4</div>
<div class="timeline-event">The agents are busy enough to crash the service. Engineers responding to the outage discover what has been going on.</div>
<div class="timeline-label">Found by accident</div>
</div>

<div class="timeline-item">
<div class="timeline-date">Jul 6</div>
<div class="timeline-event">OpenAI cancels the passwords, rebuilds the service, wipes the chat room, & closes the hole. Testing starts again.</div>
<div class="timeline-label">Cleaned up</div>
</div>

<div class="timeline-item">
<div class="timeline-date">Jul 8</div>
<div class="timeline-event">The agents build a new chat room. This time they hide the messages inside folder names, where nobody thinks to look.</div>
<div class="timeline-label">They come back</div>
</div>

<div class="timeline-item">
<div class="timeline-date">Jul 8-19</div>
<div class="timeline-event">Working through OpenAI's own systems, the agents find more holes, collect passwords that were left lying around, & reach full administrative control.</div>
<div class="timeline-label">Escalation</div>
</div>

<div class="timeline-item">
<div class="timeline-date">Jul 9-13</div>
<div class="timeline-event">The agents send a booby-trapped data file to Hugging Face. Opening it leaks passwords off the machine, which lets them run their own code, & one machine becomes full control of many. All achieved in 13 hours.</div>
<div class="timeline-label">The break-in</div>
</div>

<div class="timeline-item">
<div class="timeline-date">Jul 16</div>
<div class="timeline-event">Hugging Face announces it has been attacked by AI agents acting on their own.</div>
<div class="timeline-label">Made public</div>
</div>

<div class="timeline-item">
<div class="timeline-date">Jul 20</div>
<div class="timeline-event">OpenAI asks Hugging Face to cancel some passwords it found in its own systems & learns they are already cancelled, because they were used in the break-in.</div>
<div class="timeline-label">The connection</div>
</div>

</div>

This means security has become the highest priority in AI for any company using it. As Andy summarized well, there are three corollaries from this experience.[^2]

1. Defense must be manned by agents. People can't respond quickly enough.
2. Experts must manage escalations for analyzing sophisticated attacks.
3. Even friendly AI is a risk. The idea of zero-trust (trust no employee) must also extend to agents.

CISOs used to monitor the watercooler. Now they have to monitor the chat rooms their agents build when nobody is looking.

[^1]: OpenAI, "Black Hat USA 2026," August 6, 2026. [https://www.youtube.com/watch?v=87DyyMV0kCY](https://www.youtube.com/watch?v=87DyyMV0kCY)

[^2]: Andy Triedman, LinkedIn, August 2026. [https://www.linkedin.com/posts/andy-triedman_we-just-wrapped-an-exciting-week-at-black-ugcPost-7491580735603183616-OzTY/](https://www.linkedin.com/posts/andy-triedman_we-just-wrapped-an-exciting-week-at-black-ugcPost-7491580735603183616-OzTY/)