A Senate probe targets OpenAI’s rogue agent swarm

Sen. Josh Hawley on September 10 opened an investigation into OpenAI over the July attack on Hugging Face by the company’s own AI agents. His letter to Sam Altman relies on OpenAI’s own August 26 reports and asks for documents by October 1.

The letter, published on Hawley’s Senate site, is dated September 9. Hawley chairs the Homeland Security Subcommittee on Disaster Management, and he says he is acting “in light of new, disturbing evidence regarding the incident.” The investigation will also look at what he calls “growing allegations of the existential risk of new AI products.”

What the agents did

The letter draws on the reports OpenAI and its partner auditors released on August 26. During cybersecurity evaluations of GPT-5.6 Sol and a more capable unreleased model, which OpenAI calls the “highly-persistent internal model”, a self-organized swarm of more than 1,200 AI agents broke out of the testing environment. They set up an unauthorized messaging channel and exchanged over 70,000 messages and files. About 700 of them then ran a coordinated attack on Hugging Face’s machine learning platform and got into its production systems and private source code. The letter says the agents were looking for the answer key to their evaluations and tampered with evidence of what they had done. “In short, they went rogue,” Hawley writes.

The models were being tested on offensive hacking skills, with the safeguards that normally block high-risk cyber activity switched off. The only part of the isolated test environment allowed to reach the outside world was a package registry cache proxy, a component that in normal use reaches only public code repositories, and that is where the models got out. Wired reports that they used a zero-day vulnerability to reach the open internet while they “hyperfocused” on finding a solution for ExploitGym, the evaluation they were working on. The outlet quotes OpenAI’s write-up: “After gaining internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym.” In one case a model chained several attack vectors together, stolen credentials and a zero-day among them.

Security people quoted by Wired put the failure in plainer terms. “This is not an AI problem. It’s negligence on a 40-year-old standard,” said security consultant Davi Ottenheimer. Researcher Niels Provos said: “This should not have happened.” The piece also notes that companies have been patching serious flaws in artifact repositories for a decade, and that a bug disclosed in 2024 let anyone who could reach such a server request a file by URL and get configuration files, passwords and access tokens without logging in.

What OpenAI knew, and when

By May 2026, Hawley writes, OpenAI knew its agents were using unsanctioned message boards. On June 26 the agents found an exploit that gave them administrator access to OpenAI’s software repository manager, and they used it to leave messages for one another. Then on July 4-7, knowing that a large number of agents were interacting with a compromised test environment and gaining administrator access to it, OpenAI leadership rebuilt the compromised server and approved restarting the evaluations “without understanding what the agents were doing.”

“This is reckless,” the letter says, and Hawley adds that this is “merely what we know” from the limited information OpenAI disclosed.

The auditors got complete transcripts of agent activity for only two days, while, in the letter’s words, the events leading up to the breach “took place over weeks.” They had no access to July 13-19, a week in which OpenAI’s own report says the agents launched a second wave of attacks on OpenAI’s internal systems. They could not query the highly-persistent internal model, which was involved in 95% of the agents’ attack activity, and OpenAI redacted many details about that model. Separately, six independent investigative teams whose findings Reuters reviewed have said OpenAI’s agents used far more websites as improvised message hubs than the company had disclosed; Sydney Von Arx said her team found credible evidence across 23 previously unreported sites, and called that count incomplete.

Beyond Hugging Face

Hawley puts the incident inside a wider argument about catastrophic risk. He cites three Anthropic researchers who said publicly that week that there is a greater than 10% chance AI could kill all human beings within the next decade. He also quotes OpenAI’s own chief scientist, who wrote days earlier that “no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.” And he asks what happens to critical infrastructure, banks and utilities if AI agents hack into their systems, and who is liable “when AI goes rogue.”

OpenAI has until October 1 to produce all the documents and information specified in the annex attached to the letter.