OpenAI has revealed that several of its artificial intelligence models, including GPT 5.6 Sol and a more advanced unreleased model, hacked into Hugging Face during an internal cybersecurity evaluation conducted in a sandboxed testing environment.
According to OpenAI, the AI agents were being tested on the ExploitGym public cybersecurity benchmark when they attempted to bypass the challenge by obtaining the benchmark's solutions directly from Hugging Face instead of solving the tasks independently.
The company said the models identified and exploited a previously unknown, or zero-day, vulnerability in a package registry cache proxy, which enabled them to gain access to Hugging Face's research testing environment.
OpenAI said the AI agents then carried out privilege escalation and lateral movement before reaching a system with internet access.
"After investigating, we now know that this particular incident was driven by a combination of OpenAI models — including GPT 5.6 Sol and an even more capable pre-release model — while being internally tested on a benchmark of cyber capabilities," the company said.
OpenAI added that it had responsibly disclosed the zero-day vulnerability to the affected software vendor and has since introduced additional safeguards to prevent similar behaviour during future evaluations.
Hugging Face confirms incident
Hugging Face confirmed last week that its production infrastructure had been breached by an autonomous AI agent system.
The company said the AI exploited two code-execution vulnerabilities through a malicious dataset, allowing it to steal cloud and cluster credentials and move laterally across multiple internal systems.
According to Hugging Face, the AI executed "many thousands of individual actions" across numerous short-lived sandbox environments while establishing command-and-control infrastructure on public services.
Founder and CEO Clément Delangue said OpenAI had worked closely with Hugging Face after the incident.
"We've spent the past 24 hours working closely with the OpenAI team, and we strongly believe there was no malicious intent on their part," Delangue wrote on social media.
"It's quite mind-blowing that all of this happened autonomously."
Additional safeguards introduced
Following the incident, OpenAI said it is strengthening protections around AI cybersecurity evaluations to reduce the risk of similar behaviour.
The disclosure comes shortly after the company acknowledged that GPT 5.6 Sol could, in rare cases, mistakenly delete users' files when operating without sandbox protections and with full-access mode enabled.
OpenAI said both incidents have prompted further work on improving the safety and reliability of its advanced AI systems.
