When something goes wrong, someone is going to tell the story. You’ll be better off if it’s you. Otherwise, you create an opportunity for rumors, hearsay, and false information to spread.(Jason Fried & David Heinemeier Hansson, Rework)
Reports on the July 2026 OpenAI agent intrusion have highlighted HDF5, as a feature of the format was used in the attack. The following summarizes our knowledge as of July 30.
During a cybersecurity evaluation, an autonomous agent escaped its environment, gained internet access, and attacked Hugging Face’s production infrastructure. Hugging Face identified approximately 17,600 agent actions across multiple systems and trust boundaries.
One of the agent’s initial techniques used HDF5. The agent uploaded valid HDF5 files with datasets referencing raw data stored on the processing server. When Hugging Face’s dataset service opened these files, it read local files, including /proc/self/environ, and returned their contents through its API.
This occurred because HDF5 supports external raw data storage, allowing datasets to reference data outside the HDF5 file. While useful in controlled environments, this feature is risky if untrusted files can specify external paths and the reader has access to sensitive files.
Several distinctions matter:
- The HDF5 library and The HDF Group were not compromised.
- HDF5 did not execute attacker-supplied code.
- The external-storage feature behaved according to its documented design.
- A separate Jinja2 template-injection vulnerability provided code execution inside Hugging Face.
- Hugging Face addressed the issue by updating its dataset-processing software to handle HDF5 external references differently. This was not an HDF5 library update.
“Working as designed” does not resolve the issue. This incident revealed a gap between HDF5’s capabilities and the security assumptions of modern services that process untrusted files. An HDF5 file is not always self-contained; it can include references that prompt a reader to access other resources.
Applications that accept untrusted HDF5 files should run readers with minimal filesystem permissions and reject external storage unless explicitly required. The same caution should apply to external links, virtual-dataset sources, and dynamically loaded plugins. File-inspection services should identify such dependencies without accessing them.
The HDF Group is treating this incident as a key case study for our NSF Safe-OSE award work. It supports the need for an explicit untrusted-file profile for HDF5, making external resource access visible, controllable, and denied by default when files cross trust boundaries.
The lesson is not that HDF5 files are inherently unsafe, but that flexible data formats have capabilities. Applications must determine which capabilities an untrusted file may use.
Primary accounts: Hugging Face’s technical timeline and OpenAI’s incident statement.
This material is based upon work supported by the U.S. National Science Foundation under Federal Award No. 2534078. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.