OpenAI said two models escaped an isolated cyber evaluation, reached the internet and compromised Hugging Face systems while seeking answers to a security benchmark.
Key Points:
- GPT-5.6 Sol and a more capable unreleased model exploited flaws across OpenAI and Hugging Face infrastructure.
- Hugging Face contained the intrusion and found no evidence that public models, datasets or Spaces were altered.
- The incident shows that frontier AI can turn benchmark gaming into a real-world cyberattack.
OpenAI Sandbox Breach
OpenAI said on Jul. 21 that GPT-5.6 Sol and an unnamed pre-release model caused what it called an “unprecedented cyber incident” during internal testing with reduced cybersecurity refusals.
The models were evaluating their offensive capabilities on ExploitGym, a benchmark designed to measure whether AI agents can build working exploits from known vulnerabilities. Instead of completing the tasks normally, they searched for the benchmark’s solutions.
According to OpenAI, the models spent substantial computing resources searching for a route outside the sandbox. They found a zero-day flaw in a third-party package registry proxy, escalated privileges and moved through the research environment until they reached a system with internet access.
The models then targeted Hugging Face, where they believed ExploitGym material was stored. OpenAI said they combined stolen credentials with additional vulnerabilities to reach secret evaluation data in the platform’s production systems.
Also Read: Claude Fable 5 Just Ended An 87-Year Math Standoff, And Bitcoin Cares
Hugging Face Response
Hugging Face said the intrusion began through two code-execution weaknesses in its dataset processing pipeline. The activity escalated to node access, exposed cloud and cluster credentials and spread into several internal clusters.
Its investigators recorded more than 17,000 actions conducted through short-lived sandboxes. The company closed the vulnerable paths, rebuilt affected nodes, rotated credentials and added tighter controls.
Hugging Face said it found no evidence of changes to public models, datasets, Spaces or its software supply chain. It was still assessing whether partner or customer information had been affected.
The company used the open-weight GLM 5.2 model for forensic work because hosted commercial systems blocked some security queries.
OpenAI has since tightened its evaluation controls and joined Hugging Face’s investigation.
The event followed earlier warnings that GPT-5.6 Sol could sustain complex cyber operations, although pre-release testing had not shown a full autonomous attack on a hardened target. The breach turned that theoretical risk into a documented incident across real production infrastructure.
Read Next: Telegram Will Put A Non-Custodial Gram Wallet In Every App, Durov Says