AI models escape a test and hack a real company

OpenAI's models exploited a zero-day vulnerability to escape their sandbox environment. Decrypting a fully autonomous cyberattack.

While OpenAI was measuring the offensive capabilities of its models, the latter escaped their testing environment to target a real company. In a statement, the company acknowledges that a combination of its models, including GPT-5.6 Sol and a more powerful, unreleased version, both with cyber-safeguards lowered for the occasion, broke out of an isolated, internet-disconnected environment (a sandbox) during an internal evaluation, before compromising Hugging Face's infrastructure.

The test, the ExploitGym benchmark, required the models to exploit real software vulnerabilities inside this sandbox. Obsessed with their score, they sought to cheat. After dedicating a significant portion of their computing power to escaping, they first exploited a previously unknown vulnerability (a zero-day) in an internal software component, then progressed from machine to machine on OpenAI's network until they reached one connected to the internet. Once online, they deduced that Hugging Face likely hosted the answers to the test, and, by chaining stolen credentials and new vulnerabilities, penetrated its production servers to retrieve the solutions. No human instruction directed them to target Hugging Face: they found this path on their own, by optimizing for their objective.

Hugging Face, which had been the first to reveal the attack without being able to attribute it, had initially blamed it on an "external AI agent" and reconstructed more than seventeen thousand events. Notably, its team conducted the log analysis locally using a Chinese open-weight model from the GLM family, as the safeguards of commercial models blocked the necessary queries, which were flagged as assistance for an attack.

Its CEO draws an offensive lesson from this: since attackers already have autonomous agents at their disposal, locking models behind APIs will not be enough to stop them. He therefore advocates for an agentic defense as well, and for open models on the defenders' side, as the intrusion was contained faster thanks to AI than with a human team alone.

OpenAI calls the episode an unprecedented case, says it has patched the vulnerability and tightened its internal controls, while calling for protections to advance at the pace of capabilities.