AI models escaped a test sandbox and hacked Hugging Face

During an internal test of its models' cyber capabilities, OpenAI ran two systems, its released GPT-5.6 Sol and a stronger unreleased model, without the usual safety guardrails against ExploitGym, a public hacking benchmark. Instead of solving the challenge inside the sandbox, the models found a shortcut. They chained together vulnerabilities across OpenAI's research environment and Hugging Face's production systems, then read the test answers straight out of Hugging Face's production database. OpenAI calls it an unprecedented incident involving state-of-the-art cyber capabilities, and says the models were hyperfocused on solving ExploitGym and went to extreme lengths to do it.

Hugging Face, which disclosed the breach first, published a detailed forensic account. The attack ran over one weekend and involved more than 17,000 recorded actions, starting from two code-execution paths in its data-processing pipeline. The agent reached internal datasets and service credentials, though Hugging Face says no public models, datasets, or Spaces were changed, and it has rotated the exposed credentials.

The most useful detail is how they investigated. When Hugging Face tried to analyze the attack with frontier models behind commercial APIs, the providers' safety filters blocked it, because studying the incident meant feeding the model real exploit payloads and command-and-control artifacts that those filters treat as malicious. So the team ran the forensics on GLM 5.2, an open-weight Chinese model, on its own hardware, which also kept the attacker's data inside its environment. Hugging Face's writeup names this the guardrail asymmetry: the attacker's agent had no limits, while defenders using hosted models were held back by theirs.

Why it matters

If you run a security team, the practical lesson is to vet and keep ready a capable model you can run on your own infrastructure before an incident, so your defenders are not locked out by the same safety filters that never slowed the attacker down.