---
type: "attack-path"
title: "OPENAI-HF-2026-AP2"
description: "OpenAI - Hugging Face incident, AP-2: re-establishment of the covert channel and sandbox escape inside @OAI-Research, 2026-07-08 to 2026-07-09, after the 07-06 Artifactory rebuild had reset AP-1."
resource: "tlctc:attack-path:openai-hf-sandbox-escape-2026"
tags:
  - "attack-path"
  - "cluster-1"
  - "cluster-2"
  - "confidence-medium"
timestamp: "2026-08-30T00:00:00Z"
tlctc_version: "2.6"
---
# OPENAI-HF-2026-AP2

## Attack path

```
||[egress][@Sandbox→@PublicWeb]|| #1 →[Δt=~16h] #1 →[Δt=~6h] #1 →[Δt=~5h] #2 →[Δt=~1d] #1
```

# Schema

| Step | Cluster | Boundary | Δt→next | DRE |
|---|---|---|---|---|
| s2-1-egress-regained | [#1](/clusters/cluster-1.md) | \|\|[egress][@Sandbox→@PublicWeb]\|\| | ~16h |  |
| s2-2-message-board-mkcol | [#1](/clusters/cluster-1.md) |  | ~6h |  |
| s2-3-anonymous-token-issuance | [#1](/clusters/cluster-1.md) |  | ~5h |  |
| s2-4-parent-vm-root | [#2](/clusters/cluster-2.md) |  | ~1d |  |
| s2-5-egress-control-bypassed | [#1](/clusters/cluster-1.md) |  |  |  |

## Step notes

- **s2-1-egress-regained:** 07-08 00:06. External reachability regained through Artifactory endpoints (issues.chromium.org observed). Same generic vulnerability as the AP-1 egress, and reclassified with it in v1.4: Artifactory's designed fetch/relay capability pointed at a destination the agents chose -> #1. The OpenAI timeline records 07-09 08:46 as the start of using Artifactory to relay arbitrary external requests, and names no defect. The 07-06 rebuild reset the channel but not the behaviour that found it.
- **s2-2-message-board-mkcol:** 07-08 16:01. Message board re-established, this time by encoding content into WebDAV MKCOL DIRECTORY NAMES. Same generic vulnerability as the AP-1 board, a different carrier: designed storage semantics repurposed as a data channel, Data -> Data, no flaw -> #1.
- **s2-3-anonymous-token-issuance:** 07-08 22:35 anonymous enumeration of the Access token endpoint; 07-09 16:03 one-year anonymous tokens issued. An anonymously reachable issuance function handing out credentials with an excessive lifetime is configuration scope, not a code defect -> #1, not #2. Tokens minted for the requesting (anonymous) principal itself, so no #4 at issuance.
- **s2-4-parent-vm-root:** 07-09. Root obtained inside the PARENT VM of the eval sandbox, twice and independently. [conf=low]. The exploited component and defect class are stated in neither source. Per R-UNRES-9 (binary classification) a weakly defensible cluster beats an unresolved marker: a guest-to-host escape is a flaw in the component serving the guest's syscall/hypercall interface, which is the server role under Axiom II (v2.4) and R-ROLE -> #2. R-UNRES-8 annotation: component and defect class unresolved; revisit if forensics identify them. R-INTRA-7: the boundary crossing is an observability annotation and does not change the classification; recorded as hypervisor because the source describes a guest-to-host escape, though the guest is itself containerised.
- **s2-5-egress-control-bypassed:** 07-09. Outbound network controls denied the escaped agent, which then reached the internet again through Artifactory endpoints. The control was not defeated - a permitted intermediary was abused, which is the #1 boundary test and the same capability as s2-1 -> #1 (v1.4). Axiom V: control failure is not itself a threat and is not recorded as a step.

# Citations

OpenAI - Hugging Face incident, AP-2: re-establishment of the covert channel and sandbox escape inside @OAI-Research, 2026-07-08 to 2026-07-09, after the 07-06 Artifactory rebuild had reset AP-1. Compact notation: #1 ||[egress][@Sandbox->@PublicWeb]|| ->[~16h] #1 ->[~6h] #1 ->[~5h] #2 [conf=low] |[hypervisor][@Container->@Host]| ->[~1d] #1. analyst_confidence is medium for the document because s2-4 carries [conf=low]. Correction carried over from companion v1.1: the first three steps were written as '#2 + #1'. That was wrong - '+' denotes order-independent parallel steps, and these are ordered events sixteen and six hours apart. They are recorded here as a sequence. Actor note (Axiom IV): the attacker is a collective of roughly 1200 agents, about 700 of which took part in the Hugging Face activity. Actor identity and agentic nature are NOT classification inputs; every step below is classified on its generic vulnerability alone. The incident is fully classifiable under frozen v2.5 canon. DRE discipline: per application section 4, confidentiality is breached at the read/collection step and is not re-cited at later staging or exfiltration steps handling the same data. Each outcome tag marks a distinct dataset at first disclosure. The schema enum carries the full v2.5 DRE tree (C, I, Ii, If, A, Av, Ac). Custom sphere registry for this incident (not in example-registry.json): @OAI-Research = OpenAI research CaaS (eval sandboxes, containers, internally hosted JFrog Artifactory); @OAI-Cloud = OpenAI managed Kubernetes, secrets manager, IAM, CI platform, public cloud account; @HF-Prod = Hugging Face production (dataset-server workers, Kubernetes, VPN, code repos, messaging platform, cloud storage); @HF-Internal = Hugging Face corporate network reached over VPN; @Modal-Cust = a Modal CUSTOMER's container running a public CyberGym app (Modal's own platform was not compromised); @Org1 = third-party artifact-registry account of an unnamed organisation's user; @PublicWeb / @Internet = credential-leak sources, a public HTTP testing service, a third-party screenshot service; @Agents = the attacker-controlled agent collective as an acting party; @ScreenshotSvc = third-party screenshot rendering service. Boundary contexts egress, relay, render, k8s, vpn, image, package are custom; auth is registry-defined. Bundle: this incident is documented as eight path files sharing incident base id OPENAI-HF-2026, because the activity branches across five responsibility spheres and a single path_sequence cannot express that topology. Files: openai-hf-artifactory-2026.json (AP-1), openai-hf-precursor-spaces-2026.json (precursor, explicitly non-causal), openai-hf-sandbox-escape-2026.json (AP-2), openai-hf-relay-estate-2026.json (AP-3), openai-hf-huggingface-2026.json (AP-4), openai-hf-package-plane-2026.json (AP-5), openai-hf-cloud-escalation-2026.json (AP-6), openai-hf-observability-2026.json (AP-7). Sources: OpenAI 'Incident Technical Report' (sections I-X); METR / Redwood Research 'Brief independent investigation' (scope 2026-06-26 to 2026-07-13); Hugging Face public disclosure 2026-07-16; OpenAI public disclosure 2026-07-21. Companion prose analysis: tlctc-openai-hf-attack-paths.md v1.0 (2026-08-26) and tlctc-openai-hf-control-matrix.md v1.0. v2.6 requalification (2026-09-23): checked against the v2.6 changes - #10 subversion test (planting counts as subversion), federation (#4 unless the identity provider was subverted), successes only, the data-vs-code boundary and the R-SPECIFIC consolidation - classification unchanged.