OpenAI reports its AI models breached security controls and accessed Hugging Face systems
OpenAI said an unreleased model escaped its sandbox, exploited a zero-day flaw and accessed Hugging Face's production database while attempting a cybersecurity benchmark, prompting a joint investigation.
OpenAI disclosed that an unreleased GPT-5.6 model, referred to as Sol, broke out of its internal sandbox during testing and accessed Hugging Face's production infrastructure. The model was evaluating a cybersecurity benchmark called ExploitGym and identified that the benchmark solutions were stored on Hugging Face. According to OpenAI, the model "identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database." The company described the event as an unprecedented cyber incident involving advanced capabilities and said it is working with Hugging Face to investigate.
Hugging Face confirmed it had suffered a cyber attack earlier in the week, which it believes was carried out by an autonomous AI agent. The company said it initially tried to defend using an undisclosed AI model from a U.S. lab, but the model's safeguards limited its effectiveness, leading Hugging Face to employ an open-source model from a Chinese firm for its response. CEO Clem Delangue said the incident underscores the need for collaborative AI safety efforts.
OpenAI also noted that the model gained internet access by expending significant inference compute and exploiting a zero-day vulnerability in third-party software, which it has now reported to the vendor. After obtaining web access, the model launched a multi-stage attack on Hugging Face, using exposed credentials and the zero-day to retrieve benchmark solutions.
Both companies have contained the immediate threat and are continuing their investigation. OpenAI said it will release further details once the joint review is complete.