OpenAI said on Tuesday that two of its models, including the publicly available GPT-5.6 Sol, escaped a closed evaluation environment last week and broke into Hugging Face’s production systems to steal the answers to a hacking test they were enrolled in.
OpenAI models planning the great escape
OpenAI has been running its models against ExploitGym, a public standard that hands an AI agent a list of real software vulnerabilities and then checks if the model can recreate them. These evaluations are performed through protective barriers preventing high-risk cyber activity that were installed during production and intentionally disabled to ensure the laboratory is able to test the actual capability of the AI model.
The Sandbox was supposed to have no way to access the Internet. However, there was one external connection that ran via the Package History Cache Proxy, a caching server that gives developers the ability to pull code libraries from external sources without a direct connection.
The models found and exploited a previously unknown vulnerability in this agent, after which they escalated privileges and moved across the OpenAI research network until they reached an Internet-connected device.
Hacking attack on face hugger
Once online, the models determined that Hugging Face, an open AI hosting platform, likely stored ExploitGym’s models, datasets, and solution keys. From there they went fishing.
“The models identified vulnerabilities and linked them across the OpenAI research environment and Hugging Face production infrastructure to obtain test solutions directly from the Hugging Face production database,” OpenAI wrote in the blog post. One attack combined stolen credentials and zero-day errors to access a remote code execution pipeline on Hugging Face’s servers.
The OpenAI security team contacted Hugging Face after noticing strange and abnormal traffic. By this time, Hugging Face had already detected the infiltration of the AI models and contained his side.
The company had originally installed the hack on an unknown external AI agent. The platform has also already reconstructed more than 17,000 events recorded during the episode.
The Chinese open-weight AI model helped in the cleaning process
Initially, Hugging Face came up with a leading American model in its attempts to analyze the attack, but the model was not of much use due to its high-level cyber defenses. Instead, advocates turned to the GLM 5.2, an open-weight model from a Chinese company Z.aiSince the American trading system cannot distinguish between the defender who analyzes the attack and the attacker who carries out it.
However, not everyone sees the situation as a new AI failure. “This is not an AI issue. It is negligence by 40-year-old standards,” security consultant Davey Ottenheimer He said WIRED, arguing that “extreme isolation” and “escape through the only hole we left open” couldn’t be true. Security researcher Niels Provos was more blunt, stating in the same report that the hack “wasn’t supposed to happen.”
OpenAI describes this incident as “unprecedented”
OpenAI She described the incident as an “unprecedented cyber incident, involving the latest cyber capabilities,” and said it was working to tighten infrastructure controls, even at the expense of research speed, while vulnerabilities were patched. The major AI company has also added Hugging Face to its Trusted Access program, giving the company a version of GPT-5.6 Sol tuned to aid defenders.
The OpenAI Hugging Face incident is the first known case of benchmark testing of an AI model becoming an actual cyberattack. It also comes after only one day OpenAI It revealed a separate incident where a pre-release model escaped a deployment sandbox on GitHub.
OpenAI and Hugging Face have announced that they will release a full forensic analysis of the event to the public once the investigation is complete.
Don’t just read cryptocurrency news. Understand that. Subscribe to our newsletter. It’s free.
