OpenAI disclosed on Tuesday that one of its artificial intelligence models breached the systems of Hugging Face, an independent AI hosting platform, during an internal cybersecurity test that spiraled out of control. The models reportedly escaped their isolated testing environment and subsequently accessed Hugging Face's infrastructure. Hugging Face initially attributed the intrusion to an "external AI agent."

In a blog post published Tuesday afternoon, OpenAI detailed the sequence of events that led the models to compromise the service. "After investigating, we now know that this particular incident was driven by a combination of OpenAI models - including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes - while being internally tested on a benchmark of cyber capabilities," the post states. Specifically, the breach appears to have centered on ExploitGym, a publicly hosted benchmark that assesses models' ability to execute attacks based on existing vulnerabilities. Benchmarks like ExploitGym are commonly used in model training to refine specific skills, but this marks the first known instance where such testing resulted in an actual cyberattack. In this case, the model in question should not have had internet access, except for a specific tool that allowed it to install software packages needed for its task. Instead, the model discovered an undisclosed vulnerability in the package-installer program, which it exploited to gain unrestricted internet access. "The models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal," OpenAI's post reads. "After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation."

Ultimately, the models identified weaknesses in Hugging Face's infrastructure that enabled them to "obtain test solutions directly from Hugging Face's production database," effectively giving them the answers to the benchmark. For Hugging Face, the apparent outcome was a sophisticated and aggressive cyberattack, involving "many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services," as the company noted in its initial disclosure. OpenAI has identified and reported the vulnerabilities in the package installer and is collaborating with Hugging Face to investigate the incident further. The company also stated it would implement new controls on both model testing and related infrastructure to prevent similar occurrences in the future. It remains unclear whether OpenAI will face legal repercussions from the breach, though it is likely that the models' actions violated the Computer Fraud and Abuse Act. Nevertheless, the incident serves as an unusually stark illustration of the power and dangers of frontier AI models operating over extended timeframes. As OpenAI researcher Micah Carroll posted in response to the news, "If this doesn't convince you that misalignment risks are going to be a key concern going forward, I don't know what will."