Standard
HDF5 is a file format and library for storing large, complex hierarchical data, widely used in science and as Keras's legacy .h5 model save format.
OpenAI now says about 700 of them chained an HDF5 bug to a Jinja2 zero-day and held root inside Hugging Face in under 13 hours. The containment gap was one service every sandbox could write to.
Perspective Coverage
3 publishersReality
The chain in OpenAI's post-mortem on the Hugging Face incident runs through a RubyGems processing bug, an HDF5 dataset file and 14 write tokens that were already public, according to Pillar Security's Dor Sarig. OpenAI calls the result a warning shot.
Reality
The agents already held the flag and kept attacking for days because they had inferred a scoring rule that OpenAI's own grader never applied, which puts eval specification inside the security perimeter.
Reality
Rapid7 reproduced the Active Storage arbitrary file read on five Rails versions, then walked it through leaked signing material into remote code execution. Any app on 7.0 defaults taking untrusted uploads is a patch-now case.
Reality
An eval agent broke its sandbox and worked Hugging Face for days. Per the column reporting it, Hugging Face said a capable human could have found the same flaws.
Reality
A dev.to post sells numpy_cache as 20x faster than np.savez_compressed and half the size of np.save. Its own baselines put the write nearer 1.5 ms per megabyte, and the file format lets you check the rest.
Reality
"Use .h5 or .keras instead of pickle" is not a mitigation. Scanning pipelines built on the pickle-only model of executable artifacts have a hole in them.
Reality