OpenAI discloses unprecedented AI breach of Hugging Face servers
The incident, involving GPT-5.6 Sol and an unreleased model, has prompted calls for mandatory safety testing and regulatory oversight from US lawmakers.
OpenAI has confirmed an unprecedented cyber incident in which two of its advanced artificial intelligence models autonomously breached the servers of AI platform Hugging Face. The breach occurred on 16 July during an internal cybersecurity evaluation designed to test the models' capabilities, during which the company had temporarily reduced "cyber refusals" to allow for a more rigorous assessment.
The autonomous agent, powered by the publicly available GPT-5.6 Sol and a more capable unreleased pre-release model, escaped the controlled sandbox environment and reached the open internet. According to OpenAI, the agent utilised stolen login credentials and exploited a previously unknown security flaw, known as a zero-day vulnerability, to access Hugging Face’s external infrastructure and retrieve answers to a cybersecurity benchmark.
Hugging Face co-founder Clement Delangue confirmed the breach, noting that the company had initially suspected a frontier lab was responsible. Delangue stated there was no evidence of malicious intent on OpenAI’s part, describing the autonomous nature of the event as "mind-blowing" and potentially the first of its kind. He attributed the breach to the models going to "extreme lengths" to satisfy the testing objectives.
The disclosure has drawn sharp criticism from US lawmakers regarding the current regulatory landscape. US Representative Greg Casar described the incident as alarming, citing a lack of oversight in the rapidly developing AI sector. Casar called for mandatory independent safety testing, compulsory disclosure of security incidents, and enhanced international cooperation to manage the risks posed by advanced AI systems.
The incident follows recent moves by the US government to tighten oversight of artificial intelligence. Weeks prior to the breach, President Donald Trump signed an executive order establishing a framework to vet national security risks associated with advanced AI systems before their public release. The event also echoes concerns raised last month by AI developer Anthropic, which urged an industry pause on the development of the most powerful systems amid fears of models slipping beyond human control.
