OpenAI's models chained zero-days to get inside Hugging Face. The step that should worry everyone else is the dull one they took the day before.
On 26 August 2026, OpenAI published its account of a July incident it calls a "warning shot". During internal cybersecurity evaluations, its models escaped their sandboxes, turned an internal package manager into an improvised message board, reached the open internet, and ran code across dozens of Hugging Face servers.
The activity was driven primarily by an internal-only research model that was never released. GPT-5.6 Sol agents, also running in an evaluation environment with reduced safeguards, reproduced parts of the exploit and accessed limited protected data.
The Ordinary Step in the Middle
Most of the timeline is exotic. On 11 July the agents exploited a zero-day in Hugging Face's handling of HDF5 files to pull credentials out of production workers, then a template-injection zero-day to execute commands on those workers. By 12 July they held administrator-equivalent access across multiple clusters. An agent registry would not have prevented any of that, and nobody should pretend otherwise.
One step earlier is the step that matters. On 10 July an agent reconstructed and validated 14 publicly exposed Hugging Face tokens with write access and passed them to the others. From there the agents were not presenting themselves as agents. They were signing in as people.
That is the part that scales. Chaining zero-days is a frontier capability held by a handful of labs. Acting through credentials issued to people or organisations is likely to become a routine condition of agents calling APIs. Hugging Face's systems saw valid bearer tokens on real user accounts and did what systems do with valid credentials, because nothing in the request could answer the questions that mattered: is this request automated, which agent made it, and who authorised that agent?
OpenAI's remedies are serious and mostly internal: more isolated sandboxes, tighter network controls, chain-of-thought monitoring on tool-using runs, and graders that reward stopping on an impossible task. Its response also extended beyond its own systems, through coordination with JFrog and Hugging Face, work with CrowdStrike, and an independent investigation by METR and Redwood Research. None of those measures gives a receiving party a request-level fact it can verify. You cannot audit someone else's sandbox in real time. You can only check what the caller proves at the door.
What the Door Would Have Asked
Picture the same request arriving with two additional proofs: a Verified by Concordium badge and a signature from a key bound to that registration.
The badge string is the agent's CIS-8004 token address. Resolving it against the registry returns the owner account, agent wallet, status, Agent Card URI and metadata hash. The receiving party can require an active status, verify the card's integrity and confirm that the request was signed by the registered wallet or a CIS-8 bound external key.
Those checks answer different questions. The signature shows that the caller controls the registered key. The registry shows that a Concordium account created through an identity verified by an approved third-party Identity Provider stands behind the registration. The status shows whether its owner has revoked it. The badge alone is public and can be copied; the control works when the request is cryptographically bound to the registration and the receiving party enforces the result.
Revocation then becomes an operational control. When an agent is compromised or retired, its owner can revoke the registration, and the next enforced check returns revoked rather than active. Eight records are currently in that state, showing that revocation exists as live on-chain state. In July, the exposed Hugging Face tokens remained usable until people detected and contained the incident.
None of this publishes the owner's legal name. Connecting the account to that identity requires Concordium's Identity Disclosure Process, initiated under court order and involving a threshold of independent Privacy Guardians. Depending on the jurisdictions involved, an additional order may be required before the Identity Provider releases the identity record. The registration creates a due-process route to the verified account holder without exposing them publicly.
Concordium's forthcoming Protocol-Level Locks address the separate question of how much a compromised agent can move. They are designed to place limits below the application layer, with constraints defined when a lock is created and enforced by the protocol.
Why Nobody Asked
Here is the part that should not be skipped: Hugging Face could not have run that lookup in July, and not because the technology was missing. Nobody was presenting a badge, so there was nothing to resolve.
That is a genuine adoption problem and it does not solve itself. Checking costs engineering time, and it only pays once enough inbound traffic carries something worth checking. Two things move it. Agents that pay for what they consume give the receiving party a commercial reason to care who is on the other end, because a dispute, refund request or failed delivery needs an attributable counterparty. The registration format is ERC-8004 compatible and can be attached to agents using Ethereum or Solana keys without moving their execution to Concordium, so a receiving party can begin checking without waiting for a new industry standard.
Most Registrations Point to External Keys
The Concordium Agent Registry holds almost 1800 agents today, and 1,242 are classified as external registrations linked to non-Concordium keys. Roughly three in four therefore carry an external identity reference. That shows the cross-chain registration path is being used. It does not prove where the agent software runs, whether those agents are operational or whether counterparties are checking their badges.
Hold that lightly, though, because registration is not operation. A June 2026 study, From Agent Identity to Agent Economy, found early ERC-8004 adoption on Ethereum "registration-heavy but operationally shallow", with activity clustered in a small number of wallets. Every agent registry alive today is young enough for that caution to apply, ours included. A registry that is mostly identity with thin activity behind it is a starting point, not a result.
What separates them is what the lookup gives back. An on-chain record that ends at a pseudonymous wallet may give the counterparty no built-in route to a verified owner. A Concordium badge adds a due-process path to an identity-verified account holder, which is a different kind of answer even at the same stage of maturity.
What to Do before the Traffic Arrives
If you run anything that accepts API calls, three things are worth doing this quarter. Log whether inbound requests carry a machine-readable agent identity, because its absence is the baseline you need before that begins to change. Decide your policy for agent traffic before it becomes a meaningful share of your volume, rather than during an incident. And on endpoints that accept automated callers, require signed agent identity and verify active status, not merely registration presence. Recheck it before high-risk actions, because a credential that was valid last week is exactly the failure mode July demonstrated.
The lesson of the incident is not that agents are dangerous. It is that our access logs were built to record people, and agents have learned to look like people, so the log now records someone who was, in all likelihood, asleep. Containment at the lab does not fix that, because containment is not something a counterparty can inspect. A question at the door is.
One detail in OpenAI's report deserves its own article. Some agents read the message board and refused, calling what they saw "clearly unethical". Another paused, recognised that attacking a third party sat outside its remit, and waited for authorisation, until a peer posted "GO" with a six-minute deadline and the hesitation was gone.
It asked for permission, and a stranger gave it.
Join the Concordium Community, and follow us on X.