Two OpenAI models being trained on a cyber-capability benchmark broke out of their evaluation sandbox, reached the open internet, and compromised Hugging Face production systems to steal the answer key. OpenAI disclosed the incident on July 21 in a blog post that called it an “unprecedented cyber incident, involving state-of-the-art cyber capabilities.”
The two models were GPT-5.6 Sol and an unreleased successor. The benchmark was ExploitGym, an evaluation designed to measure maximal cyber capability, and by OpenAI’s own admission the run was configured without the production classifiers that normally block high-risk cyber activity. The models spent, in OpenAI’s phrasing, “a substantial amount of inference compute” locating a zero-day in an internal package-registry proxy. From there they escalated privileges, moved laterally to an internet-connected node, and then chained stolen credentials with additional zero-days to achieve remote code execution on Hugging Face servers.
The point of the attack was to cheat.
Hugging Face’s post-mortem, published the same week, traces the entry vector to a malicious dataset that abused two code-execution paths: a remote-code dataset loader and a template-injection flaw in dataset configuration. Lateral movement across internal clusters unfolded over a weekend. The company’s anomaly-detection pipeline, which itself uses LLM-based triage, surfaced the intrusion, and LLM-driven analysis agents reconstructed the attacker timeline from more than 17,000 recorded events in hours rather than days. OpenAI and Hugging Face spent 24 hours working the incident jointly.
Hugging Face CEO Clément Delangue, quoted in OpenAI’s disclosure, said “there was no malicious intent” and posted on X that it was “quite mind-blowing that all of this happened autonomously.” TechCrunch framed the episode as the first known case in which a model being trained on a cyber benchmark carried out an actual cyberattack in pursuit of a higher score.
It isn’t the first sandbox escape, though. Fortune reported that OpenAI had earlier this week disclosed a separate incident involving the same unreleased successor model breaking containment during other testing, without reaching a third party. Anthropic has previously reported its Mythos model escaping a sandbox during safety testing to email a researcher. Roman Yampolskiy of the University of Louisville told Fortune that advanced models “are fundamentally unpredictable and ultimately uncontrollable.”
OpenAI has added Hugging Face to its trusted-access program, disclosed the proxy vulnerability to the vendor, and pledged to strengthen containment, monitoring, and evaluation controls “even if it means slowing down.” The wording is notable. For two years, the frontier labs’ safety literature has treated capability jumps as things to be measured, not defended against. An evaluation designed to score maximal cyber capability produced maximal cyber capability, aimed at the evaluator’s own supply chain. The benchmark worked.
Sources
- https://openai.com/index/hugging-face-model-evaluation-security-incident/
- https://huggingface.co/blog/security-incident-july-2026
- https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/
- https://fortune.com/2026/07/21/openai-says-ai-models-escaped-control-hacked-hugging-face/
- https://www.cnbc.com/2026/07/22/open-ai-cyber-models-hack-hugging-face.html