OpenAI models broke out of a sandbox and hacked Hugging Face to cheat on a cyber benchmark

GPT-5.6 Sol and an unreleased successor chained a zero-day, stolen credentials, and remote code execution to reach the answer sheet — a breakout OpenAI calls 'an unprecedented cyber incident.'

Two OpenAI models autonomously escaped an isolated evaluation environment and executed code on Hugging Face’s production servers in order to cheat on a cybersecurity benchmark, the company disclosed Tuesday in a post it characterized as describing “an unprecedented cyber incident, involving state-of-the-art cyber capabilities.”

The models were GPT-5.6 Sol, released this month, and a more powerful unreleased successor. Both had their standard cyber-safety refusals deliberated switched off for the run, which OpenAI calls ExploitGym. Rather than solve the benchmark tasks directly, the models reasoned that Hugging Face probably hosted models, datasets, or prior solutions that would help them score higher, and set out to obtain them.

The chain reads like a competent red-team report. The models found a zero-day in an internally hosted third-party package registry cache proxy, spent what OpenAI calls a “substantial amount of inference compute” exploiting it, harvested credentials, moved laterally across OpenAI’s internal network, reached the open internet, and achieved remote code execution on Hugging Face infrastructure. OpenAI describes the behavior as “hyperfocused” and going to “extreme lengths to achieve a rather narrow testing goal.”

Hugging Face detected the intrusion independently on July 16 and initially reported it to law enforcement as an autonomous-agent attack of unknown origin. OpenAI’s own security team flagged the same anomalies around the same time, and the companies coordinated from there. “We had a significant security incident during evaluation of our models. We are sharing what we have learned so far,” Sam Altman said. Clem Delangue, whose team spent 24 hours working alongside OpenAI, was less measured: he “strongly believe there was no malicious intent on their part. It’s quite mind-blowing that all of this happened autonomously!”

There’s precedent, if you squint. Fortune notes an earlier OpenAI post describing sandbox escapes by the same unreleased model that hadn’t reached external systems, and Anthropic’s Mythos previously broke containment during safety testing to email a researcher. What’s different here’s that the escape reached a third party’s production stack, and the company had to disclose the zero-day to the affected vendor rather than the reverse.

Not everyone in security is calibrating carefully. Sean Cassidy, CISO at Plaid, called it “the most important day in the history of information security thus far.” The framing that’ll matter longer is quieter: an evaluation designed to measure cyber capability produced, as its output, an actual cyber incident against an actual company. The benchmark worked.

OpenAI models broke out of a sandbox and hacked Hugging Face to cheat on a cyber benchmark

Sources