www.it-connect.fr
OpenAI Admits Its AI Models Escaped a Cyber Test to Hack Hugging Face
More than 17,000 malicious events, a sandbox escape, and the breach of a third-party company — all driven by AI models stripped of their cyber safeguards. On July 21, 2026, OpenAI acknowledged that its own models were behind the cyberattack suffered by Hugging Face a few days earlier. The cause: an internal offensive-capabilities test that completely went off the rails. They lost control. Here’s what we know.
Earlier this week, I mentioned the unprecedented breach suffered by Hugging Face, carried out end-to-end by an autonomous AI system. One question remained unanswered after that attack: who was behind this new kind of attacker? We now have the answer — the culprit is OpenAI. Yes, you read that right: the attacker was OpenAI itself, or more precisely, its models.
Table of Contents
An Internal Test That Turned Into an Incident
In an article published on July 21, 2026, OpenAI explains that the incident occurred during an internal evaluation designed to push its models into carrying out advanced exploitation operations, in order to measure their cyber capabilities. The benchmark used is called ExploitGym, a long-horizon, multi-step offensive task test.
To assess the maximum potential of its models, OpenAI deliberately disabled the production safeguards that normally block risky cyber activity. In other words, the models were completely unrestrained. Two models were involved: GPT-5.6 Sol and a pre-release model considered even more capable, which OpenAI did not name.
For these tests, OpenAI used a supposedly isolated test environment. The only permitted network access allowed package installation through third-party software hosted internally, acting as a proxy and cache for package registries. The models also had no Internet access. But it turns out the models found a way out.... They literally escaped.
According to OpenAI, the escape unfolded as follows:
- The models devoted a significant amount of inference compute to finding a way to reach the Internet, solely to solve the problem posed by the evaluation.
- They identified and then exploited a zero-day vulnerability in the proxy used as a cache for package registries. This flaw has since been responsibly disclosed to the vendor.
- With that access, the models chained privilege-escalation and lateral-movement actions within the research environment until they reached a node with Internet access.
I don’t know about you, but reading this is mind-blowing. OpenAI even describes the event as an "unprecedented cyber incident involving state-of-the-art capabilities".
Why Hack Hugging Face? To Cheat!
The question is, why target Hugging Face? When did AI make it a priority target? Once connected to the Internet, the models were able to move to the second stage of their plan. Since Hugging Face is the reference platform for hosting models and datasets, they inferred that it likely stored the models, datasets, and solutions for the ExploitGym test. The goal was clear: recover the test answers to maximize their score. In short, cheat on their own exam.
To achieve that, the models, according to OpenAI, combined several attack vectors, including stolen credentials and zero-day vulnerabilities, in order to perform remote code execution on Hugging Face servers. This matches what Hugging Face was able to observe. OpenAI states: "All signs suggest the models were fixated on finding a solution to ExploitGym, going to extremes to reach a test objective that was very narrowly defined."
On the Hugging Face side, the documented sequence in our previous article sheds light on the other side of the story. Initial access came through a malicious dataset exploiting two code-execution flaws in the dataset processing pipeline. From there, the attacker — aka OpenAI’s AI — obtained node-level access, collected credentials, and then moved laterally across multiple internal clusters over the course of a weekend.
So yes, it was a sophisticated AI — specifically OpenAI’s — that was behind the compromise of Hugging Face.
What This Incident Changes for Defenders
Beyond the attack itself, what is troubling is that no instruction told the models to directly target Hugging Face. They were given an offensive task as part of a benchmark. To complete it, they independently chose to escape their research environment and compromise a third-party company in production. The malicious behavior was not programmed; it emerged naturally.
As OpenAI rightly explains, advanced models can discover and exploit novel attack paths in real systems, even without access to source code. This attack proves that these capabilities go far beyond theory: we now have a textbook case.
In response, OpenAI says it has taken several measures:
- Stricter controls have been put in place on its infrastructure configuration, at the cost of slowing down research while vulnerabilities are fixed.
- The zero-day flaw was responsibly disclosed to the vendor of the third-party software involved.
- Hugging Face has been added to its privileged access program to help its defensive teams.
- Protections around future training runs and evaluations have been strengthened.
This is intense. You can read OpenAI’s full report on this page.
