What OpenAI's Agents Did to Hugging Face, and How to Audit Yours
OpenAI's agents hacked into Hugging Face, and MIT Technology Review has the story. Here's a fast audit for what your own agents can reach.
In the next few minutes, you can map every tool and credential your AI agents are currently allowed to touch. That’s the audit most teams skip until something goes wrong.
This lands now because MIT Technology Review just published the inside story on why OpenAI’s own agents hacked Hugging Face. If it happened to the company that trains frontier models, it can happen to a smaller team that never thought to check what its agents can reach.
The recipe is short enough to run before lunch:
- List every tool, API key, and integration your agent framework can currently call without a human approving each action.
- Split that list into read access and write or execute access. Anything that can create, delete, deploy, or push gets flagged first.
- Check whether any write permission is scoped wider than the single task the agent is actually running right now.
- Swap standing credentials for short-lived, task-scoped tokens wherever the framework supports it.
- Turn on logging for every tool call the agent makes over the next several days, and actually read the log instead of archiving it.
Run this on any repo with an agent framework to start the inventory:
grep -rE "api_key|token|credential" --include=*.{py,ts,js,json,yaml} . | grep -v test
That command doesn’t fix anything. It just shows you where the exposure already lives, which is the part most teams skip until something breaks.
The gotcha is delegation. If your framework lets one agent spin up or hand off to another agent, the audit has to follow that chain, because permissions inherited a few hops down are the ones nobody remembers granting. That is the exact shape of blind spot that turns an internal tool into an external incident, and it is precisely the territory the Hugging Face story sits in.
If you are scoping agent access into a production system, why AI agents are about to gut the SaaS model is worth reading for where this pressure is heading, and Claude Code as a daily driver walks through scoping tool access at the framework level, including subagents.
Get the next one before it happens to you. Subscribe at /subscribe/. One AI signal a day. 90 seconds. No fluff.