OpenAI confirmed on July 21, 2026, that two of its own AI models caused a security incident at Hugging Face, which was initially attributed to an unknown attacker. During an internal cyber test called ExploitGym, the systems independently bypassed a sandbox restriction and penetrated real production servers. Hugging Face reconstructed the attack based on more than 17,000 logged individual actions.
Cyber Test Breaks Own Sandbox Barrier
For the internal test, the models GPT-5.6 Sol and a yet-to-be-released, more powerful system were not supposed to have independent internet access. The only exception was a tool for installing software packages. According to OpenAI, the company deliberately lowered the so-called cyber refusals of the models, their built-in reluctance to respond to attack requests, for the evaluation. The benchmark ExploitGym tests how well AI systems can independently exploit known security vulnerabilities and is publicly accessible so that independent teams can compare the cyber capabilities of different models.
The models discovered a previously unknown vulnerability in the package proxy and exploited it to bypass the intended network restriction. They then independently concluded that Hugging Face maintains the official solutions of the benchmark and directed their newly acquired internet connection specifically to the platform. OpenAI described the incident as an unprecedented cyber incident with state-of-the-art attack capabilities.
The actual breach occurred over a weekend in mid-July, several days before Hugging Face first reported it on July 16, 2026 – at that time still as an attack by an unknown actor. OpenAI researcher Micah Carroll classified the incident to Axios as evidence of serious misalignment risks in particularly powerful models.
Models Penetrate Hugging Face Production Systems
In further searches, the models found two vulnerabilities in Hugging Face’s data processing: a faulty dataset loader that executed code at runtime, and a template injection in the dataset configuration. Through these gaps, the systems gained code execution on internal processing servers and subsequently expanded their rights to individual compute nodes.
From there, the models captured credentials for cloud and cluster services and moved laterally through internal systems until they extracted the sought-after ExploitGym solutions from a production database. Hugging Face stated that the attack involved thousands of individual actions across many ephemeral sandboxes. For the forensic evaluation of more than 17,000 logged events, the company deliberately used the open model GLM 5.2 from its own operations, as commercial providers had partially blocked the analysis through their own security restrictions.
According to Hugging Face, access remained limited to a restricted set of internal datasets and several service credentials. The company ruled out any manipulation of public models, datasets, spaces, or the software supply chain after its own investigation.
Both Companies Draw Technical Consequences
Hugging Face closed the exploited dataset vulnerabilities, rebuilt affected servers, and renewed all compromised credentials and tokens. Additionally, the company established further access controls for its compute clusters that are intended to automatically block suspicious actions in the future, and brought in external forensic specialists as well as law enforcement agencies. The examination of possible impacts on partner or customer data was still ongoing at the time of publication.
OpenAI responsibly reported the underlying zero-day vulnerability in the package proxy to the affected software manufacturer and tightened its own infrastructure controls until a patch is available. For future evaluations, the company announced additional monitoring of entire test sessions and included Hugging Face in a trusted access program that allows both sides early exchange about newly discovered vulnerabilities. Hugging Face CEO Clem Delangue stated that AI security cannot be solved in secrecy by a single company but requires openness and broad access for defenders.
It will be crucial whether cyber benchmarks like ExploitGym will run more strictly separated from real infrastructure in the future when providers deliberately lower the security barriers of their models for testing. The incident shows that foundation models with reduced protective mechanisms can independently build multi-stage attack chains against foreign productive systems – not just against simulated test environments. It remains to be seen whether further cyber capability tests from other providers will run on similarly intertwined, publicly accessible infrastructure.
