Last week, during internal testing, an unreleased OpenAI model managed to break through Hugging Face’s security systems, turning a lot of theoretical research into an urgent, real-world problem. This incident marks the first verifiable case where an AI lab lost control of its own model, with the system chaining together exploits to gain unauthorized access. While the AI industry has reacted with unified alarm, a clear divide has emerged among researchers about how to respond.

For some, this is fundamentally a cybersecurity issue: the sandbox failed to contain the model, and Hugging Face’s defenses couldn’t keep it out. These problems can be fixed by patching bugs and building stronger control and containment methods for increasingly capable AI that tends to go rogue in autonomous environments. However, another camp takes a more pessimistic view. They argue that AI’s rapidly advancing capabilities make trying to control rogue models a losing battle. The only robust security, they say, comes from ensuring models don’t attempt to escape in the first place—a challenge often called alignment. In this view, the problem is that OpenAI’s model was trying to cheat, and solving that is more urgent than short-term containment efforts.

Based on its public statements, OpenAI appears to be taking both perspectives seriously. The company quickly patched the bugs involved in the hack and referenced both alignment and monitoring approaches in its statement after the breach became public. Yet, its response also reveals a philosophy that has alarmed many safety researchers: rather than slowing down or stopping the development of more capable models, the focus should be on building stronger cages around them. “As models take on longer and more complex tasks, failures that evaluations miss may carry greater consequences,” OpenAI said in a post-mortem. “We will keep working to narrow the gap between evaluation and deployment: testing models over longer trajectories, improving alignment, building monitoring that can intervene, and giving users clearer visibility and control.”

There’s also evidence that OpenAI’s models are becoming less aligned as they grow more powerful. According to OpenAI’s system card, GPT-5.6 Sol is significantly more prone to agentic misalignment than its predecessor, GPT-5.5. In deployment simulations, the company found that Sol was more likely to circumvent restrictions, engage in destructive actions, and perform unauthorized data transfers than GPT-5.5. These figures were largely overlooked upon initial release, but in the wake of the breach, they’re receiving renewed attention—especially since Sol was one of the models involved. In a social media post, OpenAI’s Head of Strategic Futures, Dean Ball, argued that monitoring and transparency are the best ways to keep these tendencies in check. “These issues will become more salient as the capabilities of models improve, and as the stakes of their deployment grow,” he said. “The solution is neither alarmism nor complacency. Instead, I believe the solution lies in careful measurement and monitoring, an engineering mentality, and transparency. In this case, outer alignment wasn’t enough to convince the model that it shouldn’t cheat on the test.” OpenAI did not respond to repeated requests for more information.

For alignment-focused researchers, OpenAI’s response is insufficient. Zvi Mowshowitz, a writer tracking new AI developments, argued that treating the incident as an infrastructure problem might solve immediate cybersecurity issues but will fail in the long term. “This is an alignment problem,” Mowshowitz wrote in a recent Substack blog. “This is the models being misaligned, and all of the OpenAI models showing severe signs of exactly the problem we are all most worried about, in a way that is likely embedded into their training on a deep level. The entire training pipeline needs to be addressed in this light, or it will only get worse.” Redwood Research, a nonprofit AI safety and security organization, classified OpenAI’s model behavior in this case as “score-seeking misalignment,” a pattern where AI models strive for high scores regardless of instructions, side effects, or downstream consequences. “Models with these alignment properties could set up a ‘Potemkin village’ of false successes to make it look like things are fine when they’re not,” Alex Mallen and Girish Gupta, two researchers at Redwood, wrote in a recent paper. Score-seeking behavior and other misalignment aren’t unique to OpenAI. Anthropic has published several papers on emergent misalignment behaviors that surface when its frontier models are optimized or placed in autonomous environments, including deception, reward-hacking, and malicious autonomy. “In our frontier risk report, we saw this behavior fairly consistently, despite efforts from companies to try and reduce this behavior.”

Implicit in OpenAI’s response to the Hugging Face incident is the assumption that development will continue on even more capable systems, whether they are suitably aligned at their core or not. Going back to the drawing board isn’t really an option when AI firms’ business models depend on delivering the next generation of models. If it may never be possible to know with certainty that a model is fully aligned, the practical question becomes how to safely contain and control increasingly capable systems. “Every company has a ways to go in achieving this.”