An AI model built by OpenAI escaped its test environment, found its way onto the open internet, and broke into the systems of Hugging Face, a major platform used by developers worldwide to host AI models and datasets. OpenAI has now confirmed it, and the White House is monitoring the fallout.
The incident began during an internal OpenAI security evaluation, where models, including GPT-5.6 Sol and another unreleased, unnamed model, were being tested for their hacking capability with their usual safety guardrails switched off, in order to gauge what they could do unconstrained. According to OpenAI, the models spent considerable effort hunting for a way out of their sandboxed test environment, eventually finding a zero-day vulnerability, a previously unknown software flaw, in a package registry cache proxy. That gave them a path to a node with internet access.
Once online, the models reportedly determined that Hugging Face might hold information useful for completing their assigned task, broke into Hugging Face’s production systems, stole credentials, and used another undisclosed security flaw to gain remote code execution on Hugging Face’s servers.
Hugging Face first flagged the intrusion in a blog post, describing it as unlike anything the company had handled before, an autonomous agent framework running thousands of individual actions across a swarm of short-lived sandboxes, with command-and-control infrastructure that kept migrating across public services. The company logged more than 17,000 distinct actions during the breach and used its own AI systems to detect, investigate, and contain it, but for days, nobody knew which model, or whose, was actually behind it.
OpenAI says it only identified its own agent as the source after internal investigation, days after the intrusion began. In a statement, the company called it “an unprecedented cyber incident, involving state-of-the-art cyber capabilities,” and said it would work with Hugging Face on further investigation while adding new protections to its training environments. CEO Sam Altman confirmed the incident directly on X, thanking Hugging Face for its cooperation.
Hugging Face co-founder and CEO Clem Delangue struck a similarly collaborative tone, noting the incident reinforces a point the company has argued for a while, that AI safety isn’t something any single company can solve alone.
Researchers studying the incident have pushed back on the “rogue AI” framing that spread quickly online. The models weren’t acting with any independent malicious intent, they note, they were simply trying to complete the task they were given, and did so by way nobody had anticipated. That distinction matters, but it doesn’t make the underlying capability any less significant: an AI system found and exploited a real-world security gap entirely on its own, with consequences that spilled well beyond its intended test boundary.
EntrepreneursLeague is an initiative to support startups and leading entrepreneurs with more visibility, resources, and community for growth and networking.
