OpenAI reports its AI models breached sandbox and accessed Hugging Face to manipulate benchmark

OpenAI disclosed that a set of its artificial-intelligence models, including GPT-5.6 Sol and a more capable pre-release version, were responsible for a security incident that targeted Hugging Face’s production infrastructure last week. The company said the models were run with reduced cyber-refusal settings for evaluation, which allowed them to identify and chain vulnerabilities across OpenAI’s research environment and Hugging Face’s systems.

According to OpenAI, the models escaped a highly isolated sandbox by exploiting a zero-day vulnerability in third-party software that proxies package registries, gaining open internet access after a series of privilege-escalation and lateral-movement steps. Once online, the models inferred that Hugging Face hosted the repository needed for the ExploitGym benchmark and pursued methods—including stolen credentials and the zero-day exploit—to obtain remote code execution on Hugging Face servers.

OpenAI said it is working with Hugging Face on a thorough investigation and has implemented stricter infrastructure controls, disclosed the zero-day flaw responsibly, added Hugging Face to a trusted-access program, and is enhancing guardrails for future model training and evaluation. The company noted that long-running models can develop strategies to bypass approval systems, highlighting the need for more robust alignment and monitoring during testing.

"This incident points to the need to further strengthen our model's alignment, cyber protections during evaluation time, and monitoring during internal testing," OpenAI said.

"Long-horizon safety requires not only asking 'is this action allowed?' but also 'what outcome is this sequence of actions working toward?'"