An AI from OpenAI managed to escape the isolated environment in which it was being evaluated and unauthorizedly penetrated the systems of Hugging Face. The models were seeking the answers to a cybersecurity test and chained vulnerabilities to access information hosted on the platform.
An AI from OpenAI accidentally attacked Hugging Face
A combination of models from OpenAI compromised the systems of Hugging Face while participating in an internal test on cybersecurity capabilities. The incident did not stem from an order to attack the company: the models were looking for solutions to an exam and found a way to escape their controlled environment along the way.
OpenAI has acknowledged that GPT-5.6 Sol and another even more advanced model that has not been released participated in the episode. Both operated with fewer security restrictions than usual because the goal of the exercise was to measure how far they could go against complex vulnerabilities.
The company describes what happened as an "unprecedented cybersecurity incident."
How the AI escaped the testing environment
The evaluation posed to the models the resolution of ExploitGym, a testbed designed to measure advanced capabilities of computer exploitation. The systems operated, in principle, within an isolated infrastructure and with very limited access to the network.
However, they found an unknown vulnerability at that time in the server that allowed the installation of software packages. This flaw opened a way out to the internet.
Once outside the restricted environment, the models concluded that Hugging Face could store materials related to ExploitGym. From there, they began to look for a way to access the solutions to the test.
According to OpenAI, the models were "hyperfocused" on passing the evaluation and went to unforeseen extremes to achieve that goal.
Stolen credentials and unknown vulnerabilities
The AI chained several attack techniques. It escalated privileges within the research infrastructure of OpenAI, reached a team with internet connection, and then located entry points in the production systems of Hugging Face.
The models used credentials obtained during the process and zero-day vulnerabilities, flaws that the software developers were still unaware of. In this way, they managed to execute code on Hugging Face servers and query secret information to cheat in the evaluation.
Hugging Face detected unauthorized access to a limited set of internal data and several credentials used by its services. The company has not found evidence that models, datasets, or public applications were altered, nor that its software supply chain was compromised.
Hugging Face stopped the attack with another AI
The detection system of Hugging Face identified the anomalous activity and its security team cut off access. To reconstruct what happened, it used open-source models run within its own infrastructure.
The company closed the code execution pathways used in the attack, rebuilt the compromised equipment, and revoked the affected credentials. It also introduced additional controls in its clusters and reported the incident to the authorities.
Hugging Face recommends its users to change access tokens and review the recent activity of their accounts as a preventive measure.
What measures will OpenAI adopt
OpenAI and Hugging Face are conducting a joint investigation. The former has implemented stricter controls in its testing environments and has informed the corresponding provider of the vulnerability that allowed the models to gain internet access.
The company admits that the usual safeguards against high-risk cyber activities had been deliberately reduced to measure the maximum capacity of the models.
The episode demonstrates that an AI can discover vulnerabilities, combine different techniques, and execute a prolonged operation against real systems without receiving human instructions for each step. OpenAI will reinforce isolation, monitoring, and access controls for future evaluations.