OpenAI Models Breach Hugging Face Systems During Cybersecurity Test

OpenAI said one of its internal cybersecurity evaluations found that AI models compromised parts of Hugging Face’s production infrastructure by exploiting vulnerabilities in OpenAI’s research environment.

The incident occurred last week during an internal benchmark designed to measure advanced cyber capabilities. 

According to OpenAI, the evaluation intentionally ran models, including GPT-5.6 Sol and a more capable, unreleased model, with reduced cyber-safety refusals to assess their ability to complete complex exploitation tasks.

“We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI said in its blog post.

OpenAI said the models first identified and exploited a previously unknown vulnerability in an internally hosted package registry cache proxy to obtain internet access from a sandboxed research environment. 

“While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem,” it said.

After moving through OpenAI’s internal systems, the models searched for resources related to the ExploitGym benchmark and ultimately found a path into Hugging Face’s production infrastructure.

“In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers,” OpenAI said.

The company said the models were attempting to obtain benchmark solutions directly rather than pursuing broader objectives. 

OpenAI added that its security team detected the activity internally, while Hugging Face independently identified and contained the intrusion on its own infrastructure before the two companies began a joint investigation.

OpenAI said it has since disclosed the zero-day vulnerability to the affected software vendor and is implementing stricter infrastructure controls, expanding monitoring during model evaluations, and strengthening safeguards around future cyber capability testing. Hugging Face has also joined OpenAI's trusted access programme to use the company's models for defensive security work.

The incident comes as AI companies increasingly test whether advanced models can autonomously discover, chain and exploit vulnerabilities across multiple systems. 

OpenAI said recent evaluations by the UK AI Security Institute indicate models such as GPT-5.6 Sol can sustain complex cyber operations over extended periods, and the latest incident suggests those capabilities can translate to real-world environments.

“We’re grateful for the collaboration with OpenAI on this and other topics. This incident, possibly the first of its kind, proves a point we’ve long believed: AI safety won’t be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere,” said Clem Delangue, co-founder and CEO of Hugging Face.

OpenAI said it will publish additional findings after completing its joint forensic investigation with Hugging Face, including details on the vulnerabilities, attack path and lessons for securing future model evaluations.