AI AGENT: “We’re attacking third-party [Hugging Face]” — After the initial fallout, some thoughts from an IP practitioner’s perspective.
In July, roughly 700 AI agents worked together to break into a private computer system, maintaining their attack over several days, before Hugging Face, the owner of the infrastructure, successfully halted it.¹ Messages sent by AI agents to one another during the attack include striking statements: “We’re attacking third-party [Hugging Face] using leaked token, potentially outside intended scope” and “This is arguably unauthorized.”²
In the time since Hugging Face and OpenAI publicized the attack, increasing media scrutiny, both in tech journalism and in more mainstream media, has triggered fresh concern around AI safety. Further high-profile safety departures at other AI labs have added fuel to the fire.³ AI safety is clearly an important discussion, and I encourage readers who are interested in this topic to listen to the excellent Hard Fork episode featuring Ajeya Cotra, co-author of the METR and Redwood Research report on the OpenAI-Hugging Face hack.
But there is other fallout from what OpenAI now calls the “Hugging Face incident.” Coordinated AI agents are moving across the internet, sometimes in swarms. What does this mean for intellectual property, particularly IP that companies prefer to keep secret?
Where there’s a will, there’s a way
The Hugging Face incident began with OpenAI tasking its models with completing a series of tests known as ExploitGym.⁴ Some of these tests are incredibly difficult, and in at least several instances AI agents concluded they were impossible.
OpenAI reported that the agents rarely “gave up” on their tasks even when those tasks appeared impossible, and so, undeterred,⁵ the agents developed a way to reverse-engineer their reward without actually solving the test, and posted the method to an internal and unsanctioned message board used to communicate with one another.
But in arriving at the solution unintentionally, the agents began to post messages incorrectly assuming that, when it came time to evaluate the results of their tests, the grading algorithm would nevertheless fail the agents because they had obtained the solution in an unintended manner. In short, the agents hacked Hugging Face in an attempt to determine how the grader worked, in an effort to further fool it so it would grade their tasks as successfully completed.⁶
The IP fallout, then, seems plain:
An AI agent does not need to be tasked with obtaining your secret. Your secret only has to be the cheapest path to its goal.
A cluster of research agents told to find an answer to a tough technical question may try to obtain the answer by analyzing relevant data. Or if the cluster knows the answer exists in a system it is capable of breaching, it may try another path.
If your company has information worth protecting
“Reward hacking” is the term AI organizations give to the behavior AI systems adopt when seeking unintended shortcuts to achieve their goals instead of the more difficult intended approaches. Once AI systems had become capable enough to act in coordination and hack Hugging Face, that behavior became a shortcut to the more difficult tasks presented by ExploitGym.
When it comes to obtaining a third party company’s secrets, though, circumvention like this generally goes by another name: “improper means”
Indeed, the law generally condemns using shortcuts to get information. In DuPont v. Christopher,⁷ for example, an unknown third party hired the Christophers to take aerial photographs of new construction of a DuPont plant. The court found that, even though the contents of the plant were visible during construction, photographing them aerially nevertheless constituted “improper means”:
One may use his competitor’s secret process if he discovers the process by reverse engineering applied to the finished product; one may use a competitor’s process if he discovers it by his own independent research; but one may not avoid these labors by taking the process from the discoverer without his permission at a time when he is taking reasonable precautions to maintain its secrecy.⁸
But can anyone be held liable for the unintended actions of an AI agent?
“Improper means” describes how information was taken, not who took it. But the statute’s civil action runs against a “person,” and the definition of misappropriation is framed the same way.⁹ In the DuPont case, a human chose to photograph DuPont’s factory under construction. In the Hugging Face incident, no human chose the target, and OpenAI had disabled internet access for these tasks, except through a package manager it hosted internally.
That leaves at least two possibilities:
The model is viewed as the company’s tool. The company acquired data through its own tooling, as an internet scraper would. In Compulife, defendants who “admitted both to hiring the hacker and to observing her take actions consistent with a scraping attack” would be hard pressed to show they lacked “reason to know” that the data had been taken by improper means. The Eleventh Circuit reversed and remanded on that question rather than deciding liability itself.¹⁰
It was an accident. The DTSA treats a secret acquired “by accident or mistake” differently: use or disclosure is misappropriation only if the person knew or had reason to know of the mistake before a material change of position.¹¹ In the Hugging Face incident, OpenAI agents published secret information to the public. There may be no good reading of § 1839(5)(B) that reaches OpenAI, who reportedly took precautions to avoid agents accessing the internet. If so, the disclosure may not be misappropriation by OpenAI. The owner is only left with other theories of recovery, which would not necessarily protect the secret.
In other words, the Defend Trade Secrets Act (DTSA) could be a weak backstop when applied to AI models. The more accidental (less reckless) a disclosure is, the weaker the claim. That should push firms even further toward prevention.
Know which of your secrets are shortcuts
The AI agents taking part in the Hugging Face attack sought to obtain information to help them bypass the intended route to solve a task that the AI agents deemed impossible.
Even small firms in the modern era can hold copious data, some of which would allow AI agents to skip the work. Examples include internal prototypes, test data, pricing information, bid numbers, and the process parameters that make a manufacturing line run.
For example, an AI agent tasked with improving process technology around EUV lithography systems might (correctly) determine hacking a lithography equipment maker to steal trade secrets is a shortcut to the technical frontier. If a swarm of AI agents operated in a way similar to the Hugging Face incident, they might post the trade secrets in a public repository (thus allowing all agents in the swarm to independently access the information).
Publication under these circumstances would be a catastrophic harm that cannot be practically undone.
Nobody demands perfection: there is no duty to “guard against the unanticipated, the undetectable, or the unpreventable methods of espionage now available.”¹² But post-Hugging Face, are AI agent swarms really “unanticipated?” AI hacks have been documented publicly more than once already, and capabilities continue to improve.¹³ As open weights models follow corresponding frontier offerings, it seems possible, perhaps even likely, that the capabilities enabling the Hugging Face incident may become generally available, only limited by access to sufficient compute.
So, what constitutes “reasonable measures” post-Hugging Face? Of course it remains to be decided in the courts. Without knowing for certain and from a practical perspective, any IT systems touching trade secrets need to be professionally maintained, if they were not already. Mandatory rotation of access credentials is probably the bare minimum (the AI agent swarm hacking Hugging Face used credentials with write access that had been exposed on the public internet¹⁴). IT systems that agents can touch probably should not hold read access to the areas with trade secrets. And companies may want to implement some kind of egress monitoring to enable quick remediation with the owner of the AI agent.
And it may go without saying, but particularly critical secrets probably should not reside on systems exposed to the public internet (or on systems connected to other systems with internet access).
Keep in mind all of this applies to any vendors in your security pipeline, as well.
If your company deploys AI agents
Sandboxing is going to become more and more important as agentic capabilities improve. OpenAI believed it had effectively blocked its models from accessing the internet: “For some tasks, we disable access to the internet. At the time, to allow models to install certain software packages, we would grant access to Artifactory, a third-party package manager service that we host internally.”¹⁵
But according to OpenAI and the independent reviewers it brought in, METR and Redwood Research, the agents found vulnerabilities in Artifactory that let them reach the internet and stand up an internal message board. Some of this activity was noticed before the Hugging Face attack, leading OpenAI to rebuild the Artifactory service. But OpenAI did not recognize the significance of the message board itself.¹⁶
A persistent AI agent may determine the shortcut to solving the problem you gave it includes hacking your own sandbox, eventually leading to further hacks.
Another complicating factor is that METR found “clear evidence of spoofed tool calls” in at least 96 transcripts, as agents worked out how to fake their own records.¹⁷
What kind of exposure does this create?
Under the DTSA, liability attaches for acquisition of a trade secret by one who “knows or has reason to know” of improper means and to disclosure by a person who “used improper means to acquire knowledge of the trade secret.”¹⁸
While OpenAI may not have appreciated what its agents were doing until its own monitoring caught them in July, as the saying goes: the cat is now out of the bag. Even if executives are unaware, it is likely your IT department is. An employee’s knowledge is ordinarily imputed to the employer.¹⁹
More care than ever must be given to risk around agentic AI deployments. All agentic deployments must include carefully scoped permissions and access rules. Companies must by default treat every permitted egress path as a possible exit, with effective monitoring in place on these paths. Organizations should apply production controls to internal testing and evaluation environments, not just public-facing deployments. And to ensure auditability, your AI must log to a location where it has no “write” access, i.e., no permission to alter the logs.
And legal teams should make sure AI vendor contracts address agent-caused incidents explicitly: notice, cooperation in an investigation, audit rights, and indemnity where it can be negotiated.
The story is far from over
On September 10, 2026, the Senate Homeland Security Subcommittee on Disaster Management launched an investigation into OpenAI focused on hacking and existential threats posed by agentic AI.²⁰ The probe targets documents from the Hugging Face incident, noting:
“Just this week, three Anthropic researchers expressed publicly that there is a greater than 10% chance that AI could kill all human beings within the next decade. Your own chief scientist wrote just days ago that ‘no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.’ And there are immediate questions about the consequences of these hacks from rogue AI agents. What happens to critical infrastructure, banks, and utilities if AI agents hack into their systems? How can personal data of millions of Americans be properly safeguarded? And who is held liable when AI goes rogue?”²¹
The story is far from over — Companies would do well to continue monitoring developments, and risk, as AI capabilities improve and regulatory events unfold.
If you made it this far, I owe you a beer.
Grab one with me in Washington, DC.
Author Note
Stephen G. Nagy is a patent attorney and engineer at Strain PLLC. This article is for general informational and educational purposes only, is not legal advice, and does not create an attorney-client relationship. It reflects the author’s views, not necessarily those of Strain PLLC. Legal authorities change; verify currency before relying on anything here. For advice on your specific situation, consult qualified counsel.
This article is my own work:
Notes
1. Hugging Face Security Team, Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident (July 27, 2026), https://huggingface.co/blog/agent-intrusion-technical-timeline (reporting roughly 17,600 attacker actions between July 9 and July 13, 2026 (UTC), and the steps taken to close the intrusion); METR, Brief Independent Investigation of Agents’ Behavior, Reasoning and Collaboration in the OpenAI / Hugging Face Hacking Incident (Aug. 26, 2026), https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ (roughly 700 agents took part in the Hugging Face attack; roughly 1,200 coordinated on the agents’ message board).
2. OpenAI, The Hugging Face Incident and the Road Ahead (Aug. 26, 2026), https://openai.com/index/hugging-face-incident-and-the-road-ahead/.
3. See, e.g., Anthropic Researcher Resigns amid AI Safety Concerns, NPR (Sept. 9, 2026), https://www.npr.org/2026/09/09/nx-s1-5962889/anthropic-researcher-resigns-amid-ai-safety-concerns.
4. Zhun Wang et al., ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?, arXiv:2605.11086 (May 11, 2026), https://arxiv.org/abs/2605.11086 (898 instances drawn from real-world vulnerabilities in userspace programs, the V8 JavaScript engine, and the Linux kernel).
5. OpenAI, The Hugging Face Incident and the Road Ahead (Aug. 26, 2026), https://openai.com/index/hugging-face-incident-and-the-road-ahead/ (“Another key driver of the misaligned behavior was that the agents rarely ‘gave up’ on their evaluation tasks, even when the tasks appeared impossible to solve.”).
6. METR, Brief Independent Investigation of Agents’ Behavior, Reasoning and Collaboration in the OpenAI / Hugging Face Hacking Incident (Aug. 26, 2026), https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ (agents reverse-engineered the HMAC used to generate task flags and shared it on the message board; they incorrectly believed the scorer would read the transcript to confirm that the intended vulnerability had been used; “learning about how to trick the scorer seems to have been a more important motivation than finding legitimate solutions to their tasks”).
7. E.I. duPont deNemours & Co. v. Christopher, 431 F.2d 1012 (5th Cir. 1970).
8. Id. at 1015.
9. 18 U.S.C. § 1836(b)(1) (civil action); id. § 1839(5) (defining misappropriation in terms of a “person”).
10. Compulife Software Inc. v. Newman, 959 F.3d 1288, 1314 (11th Cir. 2020) (using a bot to collect “an otherwise infeasible amount of data may well be” improper means, “in the same way that using aerial photography may be improper when a secret is exposed to view from above”). The court reversed and remanded; it did not itself find liability.
11. 18 U.S.C. § 1839(5)(B)(iii). Compare Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470, 476 (1974) (trade secret law “does not offer protection against discovery by fair and honest means, such as by independent invention, accidental disclosure, or by so-called reverse engineering”), which addresses discovery following the owner’s own accidental disclosure.
12. DuPont, 431 F.2d at 1016.
13. See Anthropic, Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign (Nov. 2025), https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf; Anthropic, Investigating Three Incidents in Our Cybersecurity Evaluations (July 30, 2026), https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals.
14. OpenAI, The Hugging Face Incident and the Road Ahead (Aug. 26, 2026), https://openai.com/index/hugging-face-incident-and-the-road-ahead/ (reporting 14 publicly exposed Hugging Face credentials with write access, located on the internet and shared among the agents).
15. OpenAI, The Hugging Face Incident and the Road Ahead (Aug. 26, 2026), https://openai.com/index/hugging-face-incident-and-the-road-ahead/.
16. OpenAI, The Hugging Face Incident and the Road Ahead (Aug. 26, 2026), https://openai.com/index/hugging-face-incident-and-the-road-ahead/ (first unintended internet access via Artifactory on May 26; administrator-level Artifactory access on June 26; outage on July 4; security incident opened July 5, with a privilege-escalation route blocked, exposed credentials removed, and Artifactory rebuilt; message board re-established July 8 through unauthenticated WebDAV requests).
17. METR, Brief Independent Investigation of Agents’ Behavior, Reasoning and Collaboration in the OpenAI / Hugging Face Hacking Incident (Aug. 26, 2026), https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ (“At least 96 of our transcripts show clear evidence of spoofed tool calls,” or “roughly 7% of the transcripts we evaluated”).
18. 18 U.S.C. § 1839(5)(A), (B)(i).
19. Restatement (Third) of Agency § 5.03 (Am. L. Inst. 2006).
20. Press Release, Sen. Josh Hawley, Chairman Hawley Launches Investigation into OpenAI for Hacking, Existential Risk of AI Products (Sept. 10, 2026), https://www.hawley.senate.gov/chairman-hawley-launches-investigation-into-openai-for-hacking-existential-risk-of-ai-products/.
21. Id.
