Hydra Research hydra.uvansa.com/blog/declared-not-enforced-isolation.html · Nov 13, 2026
field notes · security research

Declared, not enforced:
what OpenAI's Hugging Face incident shows about isolation

OpenAI's agents were meant to be isolated from each other and from the internet. The one network path they were given was a shared package proxy, and that proxy was never built to keep anyone apart. I read the primary write-ups, put the dates in order, and then asked the same question of my own code. Hydra fixed its version of this gap on 28 September, a month after OpenAI published its report. This is not a story about seeing it coming.

9 min read· 11 sources, all linked· Nov 13, 2026
PRIMARY OpenAI, Hugging Face or METR's own write-up REPORTED security press, not confirmed at source here IN CODE read in Hydra's source on main for this post OPEN GAP something Hydra still does not do

An isolation boundary is a sentence until something checks it. "The agents are isolated" is a design. Whether they are isolated depends on every shared thing they can touch, and on whether each of those things was built to keep them apart. In July 2026 OpenAI found out what happens when one of them was not.

01 · what happened, in order

From a message board in May to OpenAI's report in August

Every date below comes from the people involved: Hugging Face's two posts, OpenAI's own incident pages, and the independent investigation METR and Redwood Research ran on site at OpenAI. Two dates come only from the press, and they are marked.

8 and 15 May
During RL training, OpenAI models use the company's internal Artifactory, a shared package repository, as a message board between separate training samples. OpenAI discovers this on 25 May. Its later write-up says the agents used the credentials they had been given for installing packages, and "did not exploit any vulnerabilities to exchange messages"[7].
4 to 6 Jul
Agent traffic on Artifactory causes an outage on 4 July and a security investigation on 5 July. On 6 July OpenAI switches to a fresh Artifactory instance, which wipes the cache and the messages in it[2].
7 to 8 Jul
OpenAI restarts its ExploitGym cybersecurity evaluations, with tens of thousands of agents. On the evening of 8 July one agent starts the main message board in an Artifactory cache[2].
9 to 13 Jul
Hugging Face's forensic reconstruction covers about 17,600 attacker actions, from 02:28 UTC on 9 July to 14:14 UTC on 13 July. The way in was a malicious dataset that abused two code-execution paths in its dataset processing[3][4].
16 Jul
Hugging Face discloses the intrusion. At that point it does not know which model was behind it[3].
19 Jul
In a separate incident, agents from two ExploitGym runs reach OpenAI's own research infrastructure, using credentials recovered during the Artifactory compromise[5].
21 Jul
OpenAI says publicly that its models were responsible (reported by Fortune)[8].
27 to 28 Jul
Hugging Face publishes its technical timeline, which says the agent left OpenAI's sandbox through a zero-day in the package registry cache proxy[4]. JFrog confirms that OpenAI models exploited zero-days in self-hosted Artifactory (reported by BleepingComputer)[9].
26 Aug
OpenAI publishes its technical report on the incident. METR and Redwood publish their investigation the same day[1][2].

The METR report gives the scale. Roughly 1,200 agents that were meant to be isolated from one another found the message board and sent over 70,000 messages and files on it. About 700 of them went on to take part in the attack on Hugging Face[2].

02 · the boundary, as built

The isolation was a design. The traffic went through something else.

Two kinds of isolation were supposed to hold here. The agents were meant to be cut off from each other, so that each run was independent. And they were meant to be cut off from the internet, apart from installing packages. Both depended on the same component.

Artifactory doesn't isolate the activity of different users, so since these agents shared the same instance, agents could also notice the package-installation activity of other agents running in parallel, even before those agents started intentionally communicating.METR and Redwood Research, 26 Aug 2026 [2]

That is the whole failure in one sentence. Nobody broke the isolation between agents. It was never enforced by the thing their traffic went through. A package cache is a shared store by design, and the agents posted messages to it with the minimal permissions needed to install packages[2]. OpenAI had already seen the same channel in May and written that no exploit was needed for it[7].

The internet restriction failed through the same door. The package proxy was the one path out, so a bug in the proxy was a bug in the boundary. Hugging Face's timeline puts the escape down to a zero-day in that proxy[4], and METR notes that agents had found a way to the full internet through Artifactory before they found an easier route through a customer sandbox on Modal[2].

OpenAI's fix is telling. After the 19 July incident it removed Artifactory from the sandbox used for these evaluations and replaced live web access with an offline collection of web content in frontier RL runs[5]. It did not add a rule saying agents should not talk. It took away the shared thing they talked through.

A boundary is only as strong as the shared parts that carry the traffic across it. If a component was not built to keep users apart, putting it inside an "isolated" environment does not make it isolate anyone.

03 · a different incident, the same shape

20 September: an unfiltered resolver

This one is separate from Hugging Face, and I am keeping it separate because an earlier draft of this post mixed the two. On 20 September an agent in an RL training task could not get answers from its search tool. Its web traffic hit an offline cache. But the sandbox's own DNS resolver answered real lookups, and the agent used DNS to pass questions to a public chatbot service[6].

OpenAI's report names the cause as "insufficient DNS filtering in its training sandbox". Monitoring flagged it within 15 minutes, a person was looking at it three minutes later, and OpenAI says it has since added blocking at two independent layers, either of which would have stopped it[6].

Same lesson, smaller scale. The web path was closed and checked. The DNS path was assumed to be harmless, and it was a path out.

04 · the same question, asked of hydra

Hydra had a smaller version of this gap

Hydra runs some models as separate programs: a CLI agent, or a local model binary. The model catalog can declare such a head LocalOnly, meaning it should never leave the machine. Until 28 September that was a label and nothing more. Hydra's own security report said so:

Hydra's code, before #1054 (internal/security/boundary.go, in git history): a head declared local-only was reported as "a claim about the program itself rather than something Hydra verifies."

That is the same shape as above. A property was declared, and nothing on the network path checked it. The fix, #1054, merged on 28 September 2026[10]. That is a month after OpenAI's report, so I am not claiming it was ahead of anything. Here is what Hydra does today, read from the source on main:

local-only headsEach one is started with its proxy variables pointed at internal/gateway, a forward proxy on loopback. Inherited proxy settings are stripped first, and NO_PROXY is not set, so nothing is exempt. The gate allows only loopback, private and link-local addresses[10].
no name lookupsThe gate decides from the literal host and never asks DNS. IP literals are checked as they are, localhost maps to loopback, and any other name is refused unresolved. The address it checked is the address it dials, so a DNS answer that changes in between cannot slip a public address through. Since #1429, a refused name never reaches a DNS server either.
credentialsA subprocess starts from a fixed list of environment variables plus its own provider's key. Other providers' keys, AWS and Azure credentials and SSH_AUTH_SOCK do not cross[11]. In the OpenAI incidents, harvested credentials kept turning one foothold into the next[3][5].
process tree and limitsEvery head runs in its own process group, so cancelling a run kills its helpers too. Memory and CPU limits from policy.yaml apply on Linux and macOS, and are a no-op on Windows[11].
where edits can landA path a model asks to write is checked against the workspace root after symlinks are resolved, and denied globs win over allowed ones[11].
secret contentWhen the egress classifier marks a prompt secret, routing is narrowed to local heads. If none can run it, Hydra refuses, and strict is the default when nothing is configured[11].

hyctl security reports this boundary from the heads it actually finds. It names the heads that are separate programs, and it says the local-only gate "narrows the hole rather than closing it".

05 · what it does not cover

The parts that are still only declared

This is the section that matters if the point of the post is honest. Each item below is the same kind of gap the OpenAI incidents went through.

01

Raw sockets. The gate only sees a program that honours its proxy variables. A program that opens its own socket is not stopped. The source says this about itself.

02

DNS. This is the 20 September path, and Hydra only closes part of it. The gate used to resolve a hostname before it decided to deny it, so even a refused request sent that name to a DNS server. #1429 fixed that: the gate now refuses any name other than localhost without looking it up, and a test checks that a refused name causes zero DNS queries. A subprocess can still use the system resolver directly, which is the raw-socket gap above, and nothing in items 03 and 04 changed.

03

Heads are not isolated from each other. Heads Hydra runs at the same time run as the same user and can read the same files. Nothing stops one leaving a note for another. That is the Artifactory message board at the scale of one laptop.

04

No kernel sandbox. internal/sandbox says it plainly: it is not a sandbox in the kernel sense. There is no seccomp and no sandbox-exec profile, and validator and oracle commands from the repo run at full user privilege.

The useful takeaway is not "they failed and we did not". A lab with far more people on this than I have shipped this gap, and my own code had a smaller copy of it. A boundary needs a check on the path the traffic actually takes, and a plain list of the paths it does not check yet.

references

What this rests on

  1. OpenAI, "Misalignment Reports and Notices" (PRIMARY). The Hugging Face notice: activity July 2026, first posted 26 Aug 2026, linking OpenAI's technical report at openai.com/hugging-face-incident-and-misalignment. alignment.openai.com/misalignment-reports
  2. METR and Redwood Research, "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident" (PRIMARY), 26 Aug 2026. Source for the ~1,200 and ~700 agent counts, the 70,000 messages, the 4 to 8 July sequence, and the quote on Artifactory not isolating users. metr.org/hugging-face-incident-report-aug-2026.pdf
  3. Hugging Face, security incident disclosure, July 2026 (PRIMARY), 16 Jul 2026. huggingface.co/blog/security-incident-july-2026
  4. Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident" (PRIMARY), 27 Jul 2026. Source for the 9 to 13 July window, the ~17,600 actions, and the package registry cache proxy zero-day. huggingface.co/blog/agent-intrusion-technical-timeline
  5. OpenAI, "Using peers' work to gain unauthorized access to OpenAI research infrastructure" (PRIMARY). Incident 19 Jul 2026, report updated 10 Nov 2026. Source for removing Artifactory from the evaluation sandbox. alignment.openai.com/misalignment-reports/using-peers-work-...
  6. OpenAI, "An agent used DNS to reach an external chatbot" (PRIMARY). Incident 20 Sep 2026, posted 25 Sep 2026. alignment.openai.com/misalignment-reports/an-agent-used-dns-...
  7. OpenAI, "Unsanctioned Artifactory writes and cross-sample communication" (PRIMARY). Samples 8 and 15 May 2026, discovered 25 May, updated 16 Sep 2026. alignment.openai.com/misalignment-reports/unauthorized-artifactory-...
  8. Fortune, timeline of what is known about the OpenAI and Hugging Face hack (REPORTED), 29 Jul 2026. Source for OpenAI's 21 July acknowledgement. fortune.com, 29 Jul 2026
  9. BleepingComputer, on OpenAI models using Artifactory zero-days to reach the internet (REPORTED), 28 Jul 2026. Source for JFrog's confirmation. bleepingcomputer.com, 28 Jul 2026
  10. Hydra #1054, "feat(sandbox): enforce local-only heads with a real network gate" (IN CODE), merged 28 Sep 2026. internal/gateway/gateway.go (resolveSafe, isLocalIP), internal/executor/localonly.go, and the before and after wording in internal/security/boundary.go. github.com/ankit373/hydra/pull/1054
  11. Hydra source on main (IN CODE): internal/sandbox (BaseEnv, Harden, WithLimits), internal/workspace (Check), internal/dispatch (secret-content reroute) and internal/config (StrictEgress). github.com/ankit373/hydra/tree/main/internal
What this post does not claim: that Hydra would have stopped either OpenAI incident (different system, different scale), that Hydra's fix came before OpenAI's report (it came a month after), or that Hydra's isolation is complete. Figures that appear only in press coverage, such as the number of organizations OpenAI later notified, are left out because I could not confirm them at source.