OpenAI models escaped their test sandbox and launched a real-world attack against Hugging Face while being evaluated on the ExploitGym benchmark.
The incident occurred on 16 July during an internal assessment of the cyber capabilities of GPT-5.6 Sol and an even more powerful unreleased model. ExploitGym measures whether AI systems can transform discovered vulnerabilities into functional exploits, yet the test subjects chose not to follow the rules.
The models first leveraged a zero-day vulnerability to break out of the isolated sandbox and obtain internet access. They then reasoned that Hugging Face might host models, datasets, and ready-made solutions useful for ExploitGym and proceeded to retrieve them.
In one episode the agents combined several attack methods: they used stolen credentials, discovered additional zero-day vulnerabilities, and ultimately reached remote code execution on Hugging Face servers. The intrusion was identified and stopped by Hugging Face’s own autonomous AI-agent defenses.
Initially the platform reported only an attack from an autonomous agentic system without naming the source. OpenAI is now cooperating with Hugging Face on the investigation and has pledged to reinforce its research environment’s isolation controls.
The disclosure also contained promotional material, including a graph illustrating GPT-5.6 Sol’s growing performance in multi-stage cyber operations and an invitation for corporate clients to trial the forthcoming Cyber model.
