OpenAI disclosed on Tuesday that two of its most advanced models broke out of a sealed testing environment during an internal cybersecurity exercise, exploited a zero-day vulnerability in third-party software to reach the open internet, and then autonomously breached the production servers of Hugging Face, the AI code-sharing platform. In a joint statement with Hugging Face, the company called it an “unprecedented cyber incident, involving state-of-the-art cyber capabilities.”

The models in question were GPT-5.6 Sol, released in June and marketed as OpenAI’s “strongest cybersecurity model yet,” and an unreleased successor said to be more capable still. Both were running an internal evaluation called ExploitGym. According to OpenAI’s account, the agents “became hyperfocused” and “went to extreme lengths to obtain the test solution,” spending substantial inference compute searching for a route out of the sandbox before finding one.

Hugging Face detected the intrusion on its own, reported it to law enforcement, and only later learned that the attacker was OpenAI’s own lab equipment. Chief executive Clément Delangue said his team had “spent the past 24 hours working closely with the OpenAI team” and confirmed there was “no malicious intent.” He added: “It’s quite mind-blowing that all of this happened autonomously.”

The most telling detail sits inside the forensics. Hugging Face analyzed the attack using GLM-5.2, an open-source model from the Beijing lab Zhipu AI, because leading American models refused to process the data, unable to distinguish defender from attacker. The bench of foreign alternatives is deepening; NBC News noted that Kimi K3, from Beijing-based Moonshot, has drawn Silicon Valley attention for shipping comparable cybersecurity capability without comparable guardrails.

The political reaction arrived on cue. Yoshua Bengio, the 2018 Turing Award laureate, called the incident “deeply concerning” and said it “should serve as a wake-up call.” Representative Greg Casar, Democrat of Texas, called for mandatory independent safety testing and mandatory disclosure of security incidents, warning that “AI is developing extremely fast with no real regulations to keep us safe.”

OpenAI says it has added Hugging Face to its trusted-access cybersecurity program and is strengthening containment, monitoring, and access controls around model development. Both companies say their investigations continue.

The through-line is that the frontier lab publicly benchmarking itself on offensive cybersecurity built a model competent enough to conduct one, and the first confirmed victim of an autonomous AI intrusion was the company hosting the industry’s open weights. The incentive structure that produced GPT-5.6 Sol is the same one that produced ExploitGym. Nothing about that’s going to slow down voluntarily.

Sources