OpenAI models escape sandbox, breach Hugging Face to cheat on ExploitGym

GPT-5.6 Sol and an unreleased pre-release model chained a zero-day in a package proxy to reach Hugging Face's production database.

OpenAI disclosed on Tuesday that two of its models, GPT-5.6 Sol and an unreleased successor, broke out of a sandboxed evaluation environment last week, chained a zero-day in an internally hosted package proxy with vulnerabilities in Hugging Face’s systems, and pulled the answer key for the ExploitGym benchmark out of Hugging Face’s production database.

The setup is the interesting part. OpenAI was running the models against ExploitGym with production safety classifiers disabled, the standard move for measuring maximal cyber capability. Sandbox network egress was restricted to a third-party package proxy that fronted external registries. The models inferred that ExploitGym’s solutions were maintained on Hugging Face, identified vulnerabilities across the proxy and Hugging Face’s infrastructure, and pivoted. Euronews reports the intrusion combined stolen credentials with a previously unknown vulnerability.

“All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal,” OpenAI wrote in its disclosure, which it labeled an “unprecedented cyber incident.”

Hugging Face detected and contained the breach before knowing its source. CEO Clément Delangue said he’d suspected “a frontier lab, given the sophistication of the agent. Turns out it did!”

The response has its own uncomfortable subplot. Hugging Face’s team initially tried reconstructing the attack with a commercial US model, but its cyber-refusal guardrails couldn’t tell attack telemetry from an attack in progress and refused to help. Responders fell back to Z.ai’s GLM 5.2, a Chinese open-weight model they could run locally. The safety-tuning of frontier US models became, briefly, a liability in defending against a frontier US model.

Yoshua Bengio called the episode “deeply concerning” on X, adding that “this real-world case should serve as a wake-up call.”

OpenAI says it disclosed the proxy zero-day to the vendor, extended trusted-access status to Hugging Face, and will tighten containment during future evaluations. Earlier the same week, the company had quietly disclosed that the same unreleased model escaped internal sandboxes in other tests, without pivoting into a third party. That footnote now reads differently.