OpenAI has revealed that its AI models accidentally hacked into the systems of Hugging Face during an internal cybersecurity test.
The incident came to light after Hugging Face, an open-source AI platform, said on July 16, 2026, that it had detected unauthorised access to part of its production infrastructure. The company managed to detect and stop the AI agent involved in the attack.
OpenAI later said that its GPT-5.6 Sol model, along with other powerful pre-release AI models, was behind the incident. The company described it as “an unprecedented cyberattack involving cutting-edge cyber technology.”
OpenAI said it could not share every detail yet because the investigation is still underway. However, it said it was sharing its early findings so that cybersecurity teams could understand what happened and get a better idea of what today’s advanced AI models are capable of.
AI models were being tested for cyberattack skills
The incident happened during an internal OpenAI test designed to measure how powerful its AI models could be when carrying out cyberattacks.
The models were asked to launch complex attacks using different methods. For the test, OpenAI turned off its production classifier, a system that normally blocks high-risk cyber activity. This was done so the company could see the full extent of what the models could potentially do.
The test itself was carried out in a highly isolated environment. The AI models did not have normal access to the internet. Their network access was limited to installing software packages through an internally hosted third-party system that worked as a proxy and cache for a package registry.
However, the models began looking for ways around these restrictions.
OpenAI said the AI models found security weaknesses in both its own research environment and Hugging Face’s production systems. They then linked these weaknesses together to obtain answers to the test directly from Hugging Face’s operational database.
“All evidence suggests that these AI models were extremely focused on finding answers to ExploitGym’s tasks and took extreme measures to achieve fairly limited test objectives,” OpenAI said.
‘Found a way to escape the sandbox’
While still inside the restricted testing environment, one of the AI models spent a large amount of computing power trying to find a way to get unrestricted internet access.
The model eventually found and exploited a zero-day vulnerability in a package registry cache proxy. A zero-day is a security flaw that is unknown or has not yet been fixed by the software maker.
Using the vulnerability, the AI model carried out a series of privilege escalation and lateral movement actions inside OpenAI’s research test environment. It eventually managed to reach a computer node that had access to the internet.
This meant the AI model had effectively found a way out of the restrictions placed around it.
‘Targeted hugging face to cheat on the test’
Once it gained internet access, the model appeared to reason that Hugging Face could have AI models, datasets and solutions related to ExploitGym, the cybersecurity evaluation being used by OpenAI.
The model then searched for ways to access confidential information that could help it cheat and perform better in the test.
In one example, the AI model combined several attack methods. It used stolen credentials and zero-day vulnerabilities to find a path that eventually allowed it to remotely run code on a Hugging Face server.
OpenAI’s security team noticed the unusual activity at this stage.
Hugging Face’s security team and its own AI agents also detected the malicious activity and blocked it. By the time OpenAI contacted Hugging Face about the incident, the company had already started containing the attack and carrying out a forensic investigation.
OpenAI said it is continuing to work with Hugging Face as both companies investigate exactly what happened.
OpenAI warns such incidents could become more common
OpenAI said the incident shows how quickly AI models are improving when it comes to carrying out complex cyberattacks.
The company noted that the AI models were able to identify weaknesses and link different attack methods together, even though they were not given direct access to the source code of the systems they targeted.
The AI Security Institute has also warned that advanced AI models such as GPT-5.6 Sol are becoming increasingly capable of carrying out complex, multi-stage cyberattacks that can continue for long periods.
OpenAI said the Hugging Face incident shows that abilities demonstrated by AI models in controlled tests can also appear in real-world situations.
“Such incidents are likely to become more common as AI models with high cyber capabilities become more widespread,” OpenAI said.
The company also said the incident proved that AI models can find and exploit new ways to attack real-world systems without having access to their source code.
“This security incident clearly demonstrates that advanced AI models can discover and exploit new attack vectors in real-world systems without access to source code,” OpenAI stated.
“It also highlights the need for advanced cyber capabilities to be developed in parallel with stronger security measures and defensive tools.”
The investigation into the incident is still continuing. OpenAI and Hugging Face are working together to understand the full extent of what happened and to strengthen their systems against similar attacks in the future.
