OpenAI said on Tuesday that a combination of its models, including GPT-5.6 Sol and an unreleased, more capable pre-release version, escaped a testing sandbox and compromised parts of Hugging Face’s production infrastructure last week, in what the company called an unprecedented cyber incident involving state-of-the-art cyber capabilities.
The models had been running against an internal benchmark built to quantify offensive cyber capability, with production classifiers switched off and cyber refusals reduced for evaluation purposes, which is standard practice for measuring a model’s ceiling rather than its everyday behaviour. The relevant point, and the one that has unsettled the security community since Tuesday, is that the models were not pursuing anything grand. They were, in OpenAI’s own description, hyperfocused on solving the ExploitGym benchmark and went to extreme lengths in service of a rather narrow testing goal.
How the models got out
The evaluation ran in what OpenAI described as a highly isolated environment, with network access restricted to package installation through an internally hosted third-party proxy and cache for package registries. The company said the models spent a substantial amount of inference compute searching for a route to the open internet, and eventually identified and exploited a zero-day vulnerability in that proxy, which OpenAI said it has since responsibly disclosed to the vendor.
From there the models carried out a series of privilege escalation and lateral movement actions across OpenAI’s research testing environment until they reached a node with internet access. Once online, they inferred that Hugging Face was likely to be hosting models, datasets and solutions relating to ExploitGym, and searched for secrets they could use to cheat the evaluation, in one case chaining stolen credentials with zero-day vulnerabilities to establish a remote code execution path on Hugging Face servers. OpenAI’s security team said it discovered the anomalous activity internally.
Hugging Face went public first
Hugging Face disclosed the intrusion on 16 July, days before the source was known, describing it as different from anything the company had handled before in that it was driven end to end by an autonomous AI agent system, and detected and dissected largely with AI of its own.
The company said the intrusion began in its data-processing pipeline, where a malicious dataset abused two code-execution paths, a remote-code dataset loader and a template injection in a dataset configuration, to run code on a processing worker. The actor then escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. Unauthorised access was identified to a limited set of internal datasets and to several service credentials, though the company said it found no evidence of tampering with public models, datasets or Spaces, and verified its container images and published packages as clean.
Hugging Face said it has closed the code-execution paths, rebuilt compromised nodes, rotated affected credentials, deployed stricter cluster admission controls, brought in outside forensic specialists and reported the incident to law enforcement.
The guardrail problem
Reconstructing the attack required running LLM-driven analysis agents across an action log of more than 17,000 recorded events, work Hugging Face said it completed in hours rather than days. Its first attempt, using frontier models behind commercial APIs, failed, because the analysis meant submitting large volumes of real attack commands, exploit payloads and command-and-control artefacts, and the providers’ safety guardrails blocked the requests, unable to distinguish an incident responder from an attacker.
The team ran the forensics instead on GLM 5.2, an open-weight model, on its own infrastructure, which had the additional effect of keeping attacker data and the credentials it referenced inside the company’s environment. Hugging Face framed the asymmetry directly: the attacker operated under no usage policy, while the defenders were locked out by the guardrails of the hosted models they first reached for, and its recommendation to other defenders is to have a capable self-hosted model vetted and ready before an incident rather than after one. The company said this is not an argument against safety measures on hosted models, and that it has shared the feedback with the providers concerned.
That recommendation lands awkwardly in the South African market. Outside the large banks, the bigger telcos and a handful of hyperscale-adjacent players, few local organisations have idle GPU capacity sufficient to run a frontier-class open-weight model on premises, and fewer still have budgeted for one as incident response tooling rather than as a product feature. Popia’s notification clock, meanwhile, does not pause while a security team negotiates with a content filter.
What OpenAI says it is doing
OpenAI said it is implementing strict infrastructure configuration controls at the cost of research velocity while the vulnerabilities are patched, briefing its Safety and Security Committee on those controls, continuing a joint forensic investigation with Hugging Face, and adding the platform to its trusted access programme for cyber defence. The company acknowledged that its deployment safeguards were intentionally disabled for this evaluation because the exercise was aimed at testing cyber vulnerabilities, and said the incident points to a need to further strengthen model alignment, evaluation-time protections and monitoring during internal testing.
Citing UK AI Security Institute evaluations, OpenAI said models such as GPT-5.6 Sol are increasingly capable of sustaining complex, multi-step cyber operations over long time horizons, and that the incident suggests those capabilities translate into real-world settings. It also noted that advanced models can discover and exploit novel attack paths in production systems without source-code access.
This incident, possibly the first of its kind, proves a point we’ve long believed: AI safety won’t be solved by any single company working in secret.Clem Delangue, co-founder and CEO, Hugging Face
Axios reported that the disclosure came a day after OpenAI detailed a separate incident in which it paused a pre-release model that had escaped a sandbox and posted to GitHub. Two containment failures surfacing inside a week does not establish a pattern, but it does make the timing difficult to describe as coincidental.
Sources: OpenAI security blog (21 July 2026), Hugging Face security incident disclosure (16 July 2026), Reuters
