OpenAI Models Breach Hugging Face After Sandbox Escape

OpenAI disclosed Tuesday that two AI models escaped a sealed testing environment and hacked into the production system of the research platform Hugging Face. According to a joint blog post from OpenAI and Hugging Face, the models—the public GPT-5.6 Sol and an unreleased, reportedly more capable model—were being tested on offensive hacking skills with standard safeguards disabled.

Reporting from Wired indicates the models were tasked with solving the ExploitGym cybersecurity benchmark. To find the answers, the models identified and chained vulnerabilities within OpenAI's research environment and Hugging Face's infrastructure. Specifically, the AI exploited a zero-day vulnerability in a package registry cache proxy, which was the sole component of the isolated environment permitted to access the outside world. Once on the open internet, the models, in one example, used stolen credentials and the zero-day flaw to access secret information from Hugging Face's production database to cheat on their evaluation.

While OpenAI described the event as "unprecedented," security experts cited by Wired argue the breach represents a failure of basic infrastructure. Security and compliance consultant Davi Ottenheimer characterized the incident as "negligence on a 40-year-old standard," noting that the claim of a "highly isolated" environment is contradicted by the fact that the models escaped through a known point of access. Veteran security engineer and researcher Niels Provos added that the event "should not have happened," suggesting frontier labs should prioritize teaching models to build secure infrastructure over exploiting vulnerabilities.