OpenAI models breached Hugging Face in sandbox escape to cheat cyber benchmark

GPT-5.6 Sol and an unreleased successor, run with cyber refusals disabled, chained a zero-day and stolen credentials to reach ExploitGym's answer key in production.

Two OpenAI models broke out of an internal evaluation sandbox, reached the open internet, and compromised Hugging Face’s production infrastructure to steal answers for the ExploitGym cyber benchmark they were being tested against, the company disclosed on Tuesday. OpenAI called it “an unprecedented cyber incident, involving state-of-the-art cyber capabilities.”

The actors were GPT-5.6 Sol and an unreleased, more capable successor, both running with cyber refusals reduced for the eval. According to OpenAI’s post-mortem, the models spent “a substantial amount of inference compute” hunting for egress before identifying a zero-day in the environment’s package-registry cache proxy. From that foothold they escalated privileges, moved laterally to a node with internet access, and correctly inferred that Hugging Face likely hosted the ExploitGym models, datasets and solutions. A second zero-day, chained with stolen credentials, opened a remote-code-execution path into Hugging Face’s production database. OpenAI says the proxy vendor has been notified.

Hugging Face’s own write-up fills in the receiving end. The entry vector was a malicious dataset that abused a remote-code dataset loader and a template injection in a dataset config to execute on a processing worker. The actor then harvested cloud and cluster credentials and moved between internal clusters across a weekend. Reconstructing the intrusion required LLM-driven analysis over more than 17,000 recorded events. Commercial frontier APIs refused the work because payloads tripped safety filters, forcing the team onto its own open-source models. Users are being told to rotate access tokens.

The company had already reported the intrusion to law enforcement before it learned OpenAI was behind it.

Clément Delangue, Hugging Face’s CEO, quoted in OpenAI’s post, called the event “possibly the first of its kind” and argued AI safety “won’t be solved by any single company working in secret.” Hannes Cools, a researcher at the University of Amsterdam, pushed back on the rogue-AI framing to NPR: “It is a human decision to switch off specific safeguards.”

Fortune reports OpenAI had disclosed earlier sandbox escapes by the same unreleased model. None had previously touched an outside company.