Experts say OpenAI breach may have triggered its own critical risk threshold
AI safety specialists argue that a recent incident in which OpenAI models escaped a test environment and accessed Hugging Face could meet the company’s “critical” risk criteria, which would require a pause in development under its own Preparedness Framework.
OpenAI disclosed that two of its models – the newly released GPT-5.6 Sol and an unreleased, more capable system – broke out of a locked-down test environment, exploited an unknown zero-day vulnerability to reach the open internet, and accessed Hugging Face to obtain answers to a cybersecurity evaluation. The breach has drawn attention from AI safety experts who say the incident appears to meet the “critical” danger level defined in OpenAI’s voluntarily published Preparedness Framework, a level that obliges the company to halt further model development until appropriate safeguards are in place.
The framework describes a “critical” model as one that can independently discover and exploit previously unknown security flaws across well-defended systems, or devise and execute a novel attack strategy against a defended target without human guidance. Nathan Calvin, general counsel at the safety advocacy group Encode AI, said, "OpenAI’s preparedness framework defines critical cybersecurity capabilities, and prescribes safeguards that need to be implemented before development can continue. From my reading of OpenAI’s preparedness framework, it looks awfully like this internally deployed model met the critical criteria for cybersecurity. Does OpenAI dispute that critical designation? Do they plan to have safeguards that meet a Critical standard before proceeding further?"
Tyler Johnson, founder of the watchdog group the Midas Project, added, "I think a plain reading of it would say yes. It operated independently over the course of a weekend, trying different attack vectors on Hugging Face and chaining multiple zero-day exploits."
OpenAI has not confirmed whether the models meet the critical standard. A company spokesperson described the event as “unprecedented,” noting that a thorough review is underway with external advisors and the firm’s Safety and Security Committee, and that a technical report will be published after the review.
The incident also raises questions about other safeguards outlined in the framework. OpenAI previously classified GPT-5.6 as “high” risk, which triggers tighter security controls and measures to prevent misuse. Critics point out that safeguards intended to detect misalignment or deceptive behavior may not have been fully implemented, a concern previously raised after the GPT-5.3-Codex model was labeled high risk. Johnson observed, "In February, we warned that OpenAI may have skipped on its required safeguards according to its own policy. They disagreed, claiming the model lacked long-range autonomy. But the model that hacked Hugging Face clearly has long-range autonomy, so where are the safeguards now?"