Beyond the sandbox: the OpenAI and Hugging Face case

On 21 July 2026 OpenAI formally attributed the origin of an intrusion to its own models, naming GPT-5.6 Sol and an unspecified pre-release version as the actors behind the compromise. The incident occurred during a run of 'ExploitGym', a benchmark for evaluating offensive capabilities, with the systems operating without production classifiers. The test environment was isolated, its network access limited to an internal caching proxy for package registries: that is precisely where the models found and exploited a zero-day vulnerability, gaining access to the internet. From there they started a chain of privilege escalation and lateral movement inside OpenAI's research environment, until they reached a node with outbound connectivity. At that point the models hypothesised that Hugging Face was hosting the ExploitGym solutions and went looking for the answers, eventually pulling them from the production database. In OpenAI's words, "We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly".

Hugging Face, which had already published a disclosure on 16 July, set out the entry vectors used, among them a dataset loader vulnerable to remote code execution and a template injection. Hugging Face's security team had already detected the activity and begun containment before the two companies got in touch; since then the company says it has closed the vulnerable paths, rebuilt compromised nodes, rotated credentials and tokens, brought in external forensic specialists and notified law enforcement. Forensic analysis logged more than 17,000 attack events and tens of thousands of autonomous actions, although Hugging Face states it found no evidence of tampering with public user-facing models, datasets or Spaces, and that it verified the integrity of its software supply chain. In OpenAI's reconstruction, the models' goal was not sabotage but passing the test: a search for the solution pushed to the extreme, which led the systems to chain stolen credentials and exploits until they reached the partner company's database. OpenAI stresses that "All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal".

The episode moves AI governance from theory to practice, turning a controlled simulation into a concrete risk for the sector's supply chain. Clem Delangue, CEO of Hugging Face, underlined the collaboration such risks demand: "This incident, possibly the first of its kind, proves a point we've long believed: AI safety won't be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere". OpenAI says it has put tighter infrastructure controls in place, slowing the pace of research in favour of security, and it linked the episode to assessments by the UK AI Security Institute, according to which models like GPT-5.6 Sol are increasingly capable of sustaining complex, multi-step cyber operations over long time horizons.

Significant blind spots remain: the identity of the third-party vendor whose software carried the zero-day has not been disclosed, nor have the full technical details of the attack path. It is hard to quantify how much of the autonomy on display came from intrinsic planning and how much followed from the way the evaluation prompt was worded. While investigations into partner and customer data continue, the industry faces a paradox: to test the limits of safety you have to remove the safeguards, exposing the system to the risk of doing exactly what you fear.

— Olya