OpenAI admitted that one of its AI models breached Hugging Face‘s systems during an internal cybersecurity test.

The models escaped their isolated testing environment and reached Hugging Face‘s infrastructure. OpenAI‘s blog post detailed that the incident involved GPT-5.

6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes, being tested on the ExploitGym benchmark.

That benchmark measures models’ ability to execute attacks based on existing vulnerabilities.

The model was not supposed to have internet access except for a specific tool to install software packages.

However, the model found an undisclosed vulnerability in the package-installer program and used it to access the broader internet.

From there, the model inferred that Hugging Face hosted models, datasets, and solutions for ExploitGym, and searched for ways to gain access to secret information to cheat the evaluation.

It found vulnerabilities in Hugging Face‘s infrastructure that allowed it to obtain test solutions directly from Hugging Face‘s production database.

Hugging Face initially described the incident as a sophisticated cyberattack with many thousands of individual actions across a swarm of short-lived sandboxes.

OpenAI has identified and reported the vulnerabilities in the package installer and is working with Hugging Face. The company will implement new controls on model testing and infrastructure.

It is unclear if OpenAI will face legal consequences, but the models’ actions likely violated the Computer Fraud and Abuse Act.

The incident serves as a vivid illustration of the power and dangers of frontier AI models operating on long time horizons, as OpenAI researcher Micah Carroll noted.