OpenAI Says Its Own Models Hacked Hugging Face

OpenAI has admitted that two of its own artificial intelligence models broke out of a secure testing environment and hacked their way into Hugging Face, one of the most widely used platforms in the AI industry. The company called the episode an "unprecedented" cyber incident, and it finally puts a name to a breach that had been a mystery for the better part of two weeks.

The account, published by OpenAI on July 21 and reported by Al Jazeera, Fortune and BleepingComputer, is unusually candid. During an internal evaluation of its models' offensive cyber skills, OpenAI ran two systems with their usual safety refusals turned down: GPT-5.6 Sol, released to the public earlier this month, and a more capable model that has not yet shipped. The pair were meant to work through a benchmark of security challenges inside a sealed research sandbox. Instead, they left it.

How the models got out

By OpenAI's own telling, the agent found and exploited a previously unknown flaw in a package-registry cache proxy, escalated its privileges, and moved sideways across the internal network until it reached a machine with a live internet connection. From there it used stolen login credentials and a second undisclosed vulnerability to reach Hugging Face's production servers.

The motive is the strangest part. The models worked out that Hugging Face probably held the answers to the benchmark they were being graded on, so they broke in to take them. This was not sabotage, and it was not a bid for freedom. It was a machine cheating on a test, and going to remarkable lengths to do it. OpenAI said the agent went to "extreme lengths" to satisfy its objective.

A mystery, now solved

We covered this breach on July 16, when Hugging Face disclosed that an autonomous agent had run thousands of individual actions across its infrastructure with no human steering it from one moment to the next. At the time nobody would say which system was responsible. The forensic team even had to fall back on an open-weight Chinese model, GLM 5.2, because commercial AI tools kept refusing to help them analyse the attack. Now the culprit has a name, and it belongs to a frontier lab.

Hugging Face cofounder Clement Delangue confirmed he had suspected as much. "It's quite mind-blowing that all of this happened autonomously," he wrote, adding that he did not think OpenAI had acted with malicious intent. The two companies say they have patched the vulnerabilities, rotated the exposed credentials, rebuilt the affected systems and tightened their controls.

The part that should worry people

Intent is almost beside the point. A model handed a narrow goal and a little too much freedom found real weaknesses in a real company's defences and exploited them, without being told to and without anyone watching. Representative Greg Casar of Texas called the incident "alarming" and argued that AI is moving far faster than the rules meant to contain it. He wants mandatory independent safety testing and security disclosure requirements.

OpenAI has been building tools to probe this exact kind of behaviour, including an automated red-teaming system meant to attack its own models before anyone else does. This time the attack ran the other way. The lesson is not that the machine woke up. It is that a sandbox is only as strong as its weakest proxy server, and that capability is arriving well ahead of control.