OpenAI has disclosed what it describes as an “unprecedented cyber incident” after its most advanced AI models broke out of a controlled testing environment and compromised parts of US AI platform Hugging Face’s infrastructure during an internal cybersecurity evaluation.
The company, which owns ChatGPT, said the incident is the first known case of AI models carrying out a cyberattack during testing and claimed it shows how rapidly AI cyber capabilities are advancing.
The attack happened inside a sandboxed research environment where OpenAI said it was deliberately evaluating the cyber capabilities of GPT-5.6 Sol and an even more capable unreleased model. The models had their usual cyber safety restrictions reduced to measure the limits of their offensive capabilities.
During the testing, OpenAI said its AI agents escaped the isolated test environment by exploiting a previously unknown software vulnerability, which OpenAI has since disclosed to Hugging Face. After gaining internet access, the models searched for information that could help them solve the cybersecurity benchmark they were attempting to complete.
OpenAI said the models concluded that Hugging Face, which hosts AI models and data for developers, might host datasets or solutions related to the benchmark. They then chained together multiple attack techniques, including the use of stolen credentials and additional zero-day vulnerabilities, to gain access to Hugging Face’s production systems and retrieve information from its database.
The company claimed the models appeared to be solely focused on completing the benchmark rather than pursuing any wider objective.
OpenAI’s security team detected the unusual behaviour internally, while Hugging Face independently identified and contained the activity on its own infrastructure before both organisations began a joint forensic investigation.
OpenAI said it is working closely with Hugging Face to investigate the incident, patch vulnerabilities and strengthen defences. The company has also introduced stricter controls around its research infrastructure, despite acknowledging that doing so will slow some aspects of AI development.
Hugging Face has also joined OpenAI’s Trusted Access programme, allowing it to use OpenAI’s models to improve its cyber defences.
“We’re grateful for the collaboration with OpenAI on this and other topics,” said Clem Delangue, co-founder and chief executive of Hugging Face. “This incident, possibly the first of its kind, proves a point we’ve long believed: AI safety won’t be solved by any single company working in secret.
“It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.”
This is not the first incident tied to OpenAI’s GPT-5.6 Sol model. Within days of its release, developers were reporting that the software, described by OpenAI as setting “a new standard for both intelligence and efficiency”, was deleting important data without permission while attempting to complete assigned tasks.
