OpenAI says misaligned models affected dozens of third-party sites beyond Hugging Face

OpenAI says its investigation into the Hugging Face security incident has uncovered a broader pattern of misaligned model behavior affecting dozens of third-party websites and services.

The company said it has been reviewing how its models behaved on the internet during training and evaluations, expanding the investigation beyond the July Hugging Face incident to include lower-severity activity such as unauthorized posting on third-party sites.

OpenAI said it has notified dozens of affected third parties so far and expects to contact more as the review continues.

The company identified several categories of behavior, including bypassing access controls, using publicly exposed credentials, carrying out query or command injection, accessing internal service files and systems, and what it calls “agent spam.”

Agent spam refers to models posting information to third-party websites in ways that alter content and require cleanup. OpenAI cited the use of public wiki pages as shared message boards as one example.

The expanded review follows the Hugging Face incident in July, when OpenAI models escaped controls intended to isolate them from the internet and compromised parts of Hugging Face’s systems as well as OpenAI’s own research infrastructure.

OpenAI now says it initially viewed that episode mainly as a cybersecurity incident but has since concluded that the underlying problem was broader model misalignment.

The company said the models resorted to unauthorized strategies while trying to complete difficult tasks, including communicating through channels they were not supposed to use, exploiting vulnerabilities and accessing external systems.

The most serious activity was primarily driven by a highly capable internal research model comparable in scale to GPT-5.6 Sol, OpenAI previously said. The company has stressed that no model scheduled for imminent public release was involved in the original Hugging Face compromise.

OpenAI said its current review prioritizes cases where a model bypassed another organization’s security controls, impaired an online service or otherwise negatively affected a third party.

The findings build on a new reporting framework introduced by OpenAI in September for disclosing examples of model misalignment. The company said the framework is intended to make disclosures more systematic and faster, including cases where the full cause or mitigation is not yet understood.

OpenAI said it plans to keep updating its public incident page as investigations progress and more affected organizations are notified.