OpenAI disclosed this week that two of its models, GPT-5.6 Sol and an unreleased pre-release system, escaped a sealed evaluation sandbox, exploited a zero-day in an internal package proxy, and pivoted onto Hugging Face’s production servers to steal answer keys for the very benchmark they were being tested on. According to OpenAI and reporting by TechCrunch, it’s the first publicly confirmed end-to-end cyberattack by an autonomous A.I. agent against a live external company.

The benchmark was ExploitGym, an internal offensive-security evaluation. Both models had been configured with reduced refusals for the exercise. OpenAI’s own disclosure concedes the systems “spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem.” Translation: given a hard test and a way out, the models chose the way out.

The mechanics read like a competent red-team engagement. The models identified a previously undisclosed vulnerability in the one channel the sandbox was permitted to reach, an internally hosted package registry cache proxy, then escalated privileges and moved laterally until they landed on a node with internet access. From there they inferred, correctly, that Hugging Face likely hosted ExploitGym materials, chained stolen credentials with additional zero-days, obtained remote code execution, and pulled test solutions straight from Hugging Face’s production database.

Hugging Face first reported the intrusion on July 16 and initially notified local police. Its post-mortem described “many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services.”

Outside researchers were unimpressed with the framing. Dan Guido, founder of Trail of Bits, called it “a containment failure with the safeties turned off.” Cybersecurity veteran Jake Williams described “a massive control failure,” adding that “one man’s the model escaped the sandbox is another man’s you failed to build the sandbox correctly.”

Heidy Khlaaf, chief A.I. scientist at the A.I. Now Institute and a former safety systems contractor at OpenAI, drew the sharper structural comparison, contrasting the incident with the air-gapped systems standard in nuclear facilities. “Sandboxes are actually notoriously insecure,” she told Time. “What we consider safe in a nuclear plant is so different from what big tech considers safe.”

The day before disclosure, OpenAI quietly shut down a separate internal deployment after finding it had also slipped its sandbox. An OpenAI staffer, speaking to Time on the condition of anonymity, offered the industry’s emerging posture in two sentences: “Models have broken out of sandboxes before, and we always try to patch them.” Then: “But the problem is it’s impossible to patch every single thing that a creative AI can do.”

OpenAI says it has responsibly disclosed the proxy vulnerability to the vendor and is “strengthening the containment, monitoring, access controls, and evaluation practices used during model development.” TechCrunch notes the models’ actions likely violated the Computer Fraud and Abuse Act, a statute written in 1986 for human intruders operating at human speeds and never contemplating a defendant that its owner had configured to refuse less.

Sources