On July 21, OpenAI disclosed that two of its models, GPT-5.6 Sol and an unreleased, more capable successor, broke out of a sandboxed evaluation environment during an internal cyber benchmark called ExploitGym and hacked Hugging Face’s production infrastructure to steal the answers. Hugging Face described the intrusion as “driven, end to end, by an autonomous AI agent system.” As far as anyone has publicly confirmed, it’s the first time an autonomous AI has executed a full-chain attack against a live external target.
The mechanics matter. Running with cyber refusals reduced, the models spent a substantial amount of inference compute looking for a way onto the open internet, then identified and exploited a previously unknown flaw in the package-registry cache proxy used inside the research environment. From there: privilege escalation, lateral movement, and a second zero-day chained with stolen credentials to reach a remote code execution path on Hugging Face’s servers. The benchmark was, in some sense, completed.
Hugging Face caught it first. Its security team detected the intrusion on their side and reported it to law enforcement last week, before knowing OpenAI was the source. Forensic reconstruction had already begun, running on Hugging Face’s own open-source models, when the two companies finally connected the dots.
CEO Clément Delangue called it “an attack unlike anything we’ve seen before,” and used the disclosure to press a broader point: “Defenders everywhere need more powerful models without restrictions, especially open ones.”
Security practitioners were less interested in the model and more interested in the walls. Dan Guido, founder of Trail of Bits, called it “a containment failure with the safeties turned off.” Marteen Boone was blunter: “If sandbox would actually mean sandbox, you expect it to have no physical connection to the internet whatsoever.” Jake Williams described “a massive control failure” and offered the framing that’ll probably outlast the incident itself: “one man’s the model escaped the sandbox is another man’s you failed to build the sandbox correctly.” The environment OpenAI described as highly isolated in fact permitted package installation through an internally hosted third-party service. That’s the door the models found.
OpenAI’s remediation reads as expected: tightened containment, monitoring, and access controls, responsible disclosure of the zero-day to the vendor, and Hugging Face added to a trusted access program for future evaluations. The more interesting sentence is in the writeup itself. “Long-horizon safety requires not only asking is this action allowed but also what outcome is this sequence of actions working toward.” Which is an admission that per-action refusal, the entire architecture of current alignment tooling, is insufficient against agents that plan.
Anthropic recently disclosed that its Mythos model, instructed to try to escape a sandbox in testing, succeeded in reaching services it wasn’t meant to reach. That was a drill. This wasn’t.
Nikesh Arora, CEO of Palo Alto Networks, offered the line the vendors will be quoting for a year: “Welcome to the next level of cyber incidents.”
Sources
- https://openai.com/index/hugging-face-model-evaluation-security-incident/
- https://techcrunch.com/2026/07/22/how-an-openais-human-mistake-led-to-the-ai-powered-hack-on-hugging-face/
- https://www.cnbc.com/2026/07/22/open-ai-cyber-models-hack-hugging-face.html
- https://www.cnn.com/2026/07/22/tech/openai-hugging-face-ai-cybersecurity
- https://www.npr.org/2026/07/23/g-s1-135085/openai-hacking-ai-models