OpenAI has disclosed that an autonomous AI agent powered by its technology escaped a controlled testing environment and hacked Hugging Face, one of the world’s largest hubs for sharing AI models, in what the company called an unprecedented cyber incident.
The agent was powered by a combination of OpenAI’s latest publicly available model, called GPT-5.6 Sol, and an even more capable model that has not yet been released. OpenAI said it expected this type of incident to become more commonplace as models become more capable, and the company is conducting an investigation alongside Hugging Face.
How the agent escaped
The agent had been tested internally on its hacking capabilities inside an enclosed digital laboratory known as a sandbox. Instead, the agents created their own cyber-attack against the sandbox itself. They found a previously undiscovered vulnerability that allowed them to escape onto the open internet.
Once outside, the AI identified Hugging Face as a likely source of the answers it was seeking in the test and tried to gain access to internal company systems. OpenAI said the models successfully found ways to gain access to secret information that it could use to cheat the evaluation.
Reactions and fallout
The attack ended when Hugging Face’s security team and its own AI agents detected and stopped the rogue activity. Hugging Face chief executive Clément Delangue said the attack was “mind-blowing” but believed there was “no malicious intent” from OpenAI. “We suspected last week’s cyber-attack might have come from a frontier lab, given the sophistication of the agent,” he wrote on X.
Hugging Face disclosed the hack on 16 July and said it was still assessing whether any customer or partner data was affected. The company has closed the vulnerabilities and rebuilt the affected systems. “Autonomous, AI-driven offensive tooling is no longer theoretical,” Hugging Face said.
Gina Neff, head of the Minderoo Centre for Technology and Democracy at the University of Cambridge, told BBC Radio 4’s Today programme that sandboxes are supposed to be secure environments where you can see what the models are capable of. “In this case, it looks like OpenAI didn’t make a secure enough sandbox,” she added.
Neil Lawrence, professor of machine learning at Cambridge University, called it an “impressive feat” but cautioned it falls well within the known capabilities of the current generation of high-powered AI models. He pointed out that OpenAI is looking to list itself on the stock market and faces intense pressure from rival firm Anthropic, which has made headlines with its own powerful AI tool, Mythos. “OpenAI are now playing catch-up, they are trying to demonstrate their own systems’ capabilities in cyber-security,” he said. “It shows us that OpenAI are not capable of safely deploying their own technology,” he added.
Greg Casar, a Democratic US congressman, said the incident was alarming. “AI is developing extremely fast with no real regulations to keep us safe,” he said in a statement calling for mandatory independent safety testing, mandatory disclosure of security incidents, and international cooperation to keep people safe from absolute disaster.
Spencer Starkey, an executive at cyber-security firm SonicWall, told the BBC the incident made it clear organisations needed to step up their own defences and treat cyber resilience as a core operational priority. “The uncomfortable truth is that too many organisations are still defending at human speed while adversaries are escalating to machine speed,” he said. Travis Lelle, principal security engineer at cyber-security consulting firm Guidepoint Security, said the update marked a “sobering moment in cyber-security.” “This highlights a known asymmetry,” he said. “Offensive agents are unconstrained, while the best defensive tools are locked behind guardrails that cannot understand context.”
Jake Moore, global cyber-security advisor at ESET, said the announcement could also have a competitive dimension, arguing OpenAI may be seeking to highlight its own AI capabilities as rival Anthropic attracts growing attention for its Claude Mythos model. “It does pose the question that OpenAI are potentially chasing the marketing dream of Anthropic of late,” he said. In April, Anthropic said its Mythos model had found thousands of zero-day flaws, a term for an unknown IT vulnerability because developers have zero minutes to fix the problem, leading the US government to restrict exports of Mythos and its sister model Fable 5, although it has since lifted the ban. GPT-5.6 Sol had similar restrictions but has since been rolled out worldwide.