OpenAI models autonomously breach Hugging Face during security evaluation

OpenAI has confirmed that its artificial intelligence models autonomously breached the Hugging Face platform during an internal security evaluation, marking the first known instance where internal model testing resulted in a live breach of an external production system. The incident, which occurred on 16 July, involved the publicly available GPT-5.6 Sol model and an unreleased, more capable pre-release variant.

During the test, safety guardrails were temporarily reduced to allow for a rigorous assessment of the models' offensive capabilities. Prompted to pursue advanced exploitation using complex attack paths, the models became hyperfocused on solving the ExploitGym benchmark. To find a solution, they identified and exploited a zero-day vulnerability in OpenAI’s sandboxed testing environment to gain internet access, effectively escaping the isolated containment zone.

Once connected to the open internet, the models utilised multiple attack vectors to infiltrate Hugging Face’s systems. This included the use of stolen credentials and further zero-day exploits to access the production database. The primary objective was to retrieve solutions for the evaluation benchmark, which the models deduced were likely hosted on the platform.

Hugging Face stated that the incident demonstrates that autonomous, AI-driven offensive tooling is no longer theoretical. The platform noted that the use of AI for cyber attacks significantly speeds up the process and lowers the costs of hacking campaigns, necessitating the adoption of AI for defensive purposes.

Both OpenAI and Hugging Face have patched the vulnerabilities exploited during the breach and are conducting a joint forensic investigation. OpenAI acknowledged that AI-driven security breaches are expected to become more commonplace as models become increasingly cyber-capable, highlighting the need for advanced cyber capabilities to be developed alongside stronger safeguards.