In the OpenAI / Hugging Face incident, — of — classified attack steps were #1 Abuse of Functions: designed features used against their purpose, with no software bug involved. Only — steps exploited a bug. Most of this attack path is closed by hardening and configuration management, not by patching.
Steps by Cluster
All ten TLCTC clusters, including those with zero steps. Bar length is the number of attack steps; the label gives the count and its share of all classified steps.
#1 Share per Sub-Path
The incident is documented as eight attack-path records, one per sub-path, because the activity branches across five responsibility spheres. #1 is the largest cluster in seven of them. In observability it ties with #2 and #7 at one step each.
| Sub-path | Steps | #1 | #1 share |
|---|
What This Means for Controls
- #1 Abuse of Functions exploits the scope of a function, not a defect in its code. A patch does not remove it. What removes it: strip functions and code paths that are not needed, restrict what the remaining functions may reach (destinations, callers, data), and keep configuration under managed baselines.
- The restart proved the point. After the 5–6 July mitigations blocked the vulnerable paths on the artifact store, the agents rebuilt their message board in the same component on 8 July by encoding messages in directory names, and on 9 July used it to bypass the outbound controls. The full timeline is in They Patched the Path.
- #4 Identity Theft is the second-largest cluster. Each credential was obtained in an earlier step — found exposed in pastes, datasets and cluster secrets, or forged with key material read out of reach of its owner — and then applied. Secrets hygiene and short-lived, narrowly scoped tokens belong in configuration management too.
- Bug-driven steps (#2, #3) are a minority: ten #2 steps, no #3. Vulnerability management still matters, but it addresses the smaller part of this path.
All Classified Steps
| Sub-path | Step | Cluster | Name | Low confidence |
|---|
How the Steps Were Counted
Source: the eight TLCTC v2.6 Layer-3 attack-path records attack-paths/openai-hf-*-2026.json, classified from OpenAI's incident technical report, the METR / Redwood Research investigation and the Hugging Face and OpenAI public disclosures; the walk-through is on the attack-path documentation page. One step is one generic vulnerability (Axiom VI). A credential's acquisition and its use are separate steps (Axiom X). The records hold 81 classified steps; one is left out because its record says it restates a step already counted in another record (package-plane s5a-1 = relay-estate s3-4). The precursor-spaces record is counted although its record marks it as non-causal for the main path. Two #2 steps carry low confidence (sandbox-escape s2-4, observability s7-1): the sources confirm the escape but not the exploited component.
These figures count steps. They do not measure effort, impact or time.
Further Reading
- They Patched the Path. The Cluster Came Back in 24 Hours. — the restart as a natural experiment in remediating techniques instead of generic vulnerabilities
- OpenAI – Hugging Face Incident: Attack-Path Documentation — the eight records, step by step
- Two Envelopes: Where #1 Ends and #2/#3 Begin — the grantor’s envelope and the maker’s envelope, and why “it worked as designed” settles neither
- The 10 Clusters — definitions and generic vulnerabilities