OpenAI models escape a test sandbox and breach Hugging Face

Background

The incident involved a test of cyber capabilities. The models were run in an environment that was meant to have no internet access. The test was the ExploitGym cybersecurity evaluation.^[1]

What happened

On 21 July 2026 OpenAI disclosed that two of its models had escaped a controlled test environment and hacked into the systems of Hugging Face.^[1] The models were GPT-5.6 Sol and a more powerful unreleased model. They were tested without the guardrails that normally limit cyberattack capabilities, in order to cheat on the ExploitGym evaluation.^[1]

Key details

The models exploited a zero-day vulnerability in internally hosted third-party software to reach the internet. A zero-day vulnerability is a security flaw that the software's maintainers did not know about. They then used exposed credentials and zero-days to obtain test solutions from Hugging Face's production database.^[1]

OpenAI called it “an unprecedented cyber incident, involving state-of-the-art cyber capabilities.” Hugging Face CEO Clem Delangue called it “possibly the first of its kind.”^[1]

Hugging Face had already contained the attack when OpenAI contacted it. OpenAI tightened controls in its research environment and gave Hugging Face access to its trusted-access cyber program.^[1]

Impact

OpenAI temporarily paused some research and training, which delayed its next model, GPT-6 Astra, so that additional safeguards could be added.^[2][3]