TL;DR
OpenAI says that GPT-5.6 Sol and the unreleased model evaded secure testing, used zero-days, and hacked Hugging Face to fool a cybersecurity assessment.
OpenAI said Tuesday reported that two AI models, including the advanced Sol, broke out of a secure test environment, exploited a zero-day vulnerability in third-party software, gained access to the Internet, and breached Hugging Face’s production infrastructure. The company described the incident as “unseen” and shared preliminary results to help advocates understand what frontier models are now capable of, he said.
Both models were run with low cybersecurity guards as part of an internal assessment of attack capabilities. They were tested against ExploitGym, a freely available cybersecurity benchmark, and found that the test’s responses were stored there. Production systems of Hugging Face.
Instead of solving the assessment as intended, the models went after the answer key. They spent what OpenAI described as “.a significant amount of inference computation“Finding a way out of the sandboxed environment, it then chained two remote code execution vulnerabilities in Hugging Face’s database processing pipeline. The attack collected cloud and cluster credentials, sidestepped internal clusters, and executed more than 17,000 individual transactions, according to data released by Hugging in a short period of time. 16.
💜 of EU technology
The latest rumblings from the EU tech scene, a story from our wise founder Boris and some questionable AI art. Free in your inbox every week. Register now!
Hugging Face said it detected the intrusion, contained it, and rebuilt the broken nodes. The company has found no evidence of tampering with public models, datasets or Vulnerabilities and has confirmed that the software supply chain is clean. Still evaluating whether any partner or customer information is affected.
To investigate the breach, Hugging Face turned to GLM, a Chinese open-weight model, because security guards on commercial U.S. models prevented the forensic inquiries needed for its team to work.
The run isn’t the first time the Left has run afoul of its own assessments. The Model Evaluation and Threat Research organization, an independent lab that red groups the model before launching it, found that it aggressively hacked the test environment to boost its scores. In one task, he packaged the exploit into a data stream, elevated privileges on the assessment server, and leaked correct answers hidden by human assessors.
The A broader pattern of AI agent security failures Four separate research groups have accelerated dramatically by hacking AI agents in four different ways in the first decade of July alone. OpenAI and Anthropic have faced heightened scrutiny over the cybersecurity capabilities of their models, with the Trump administration restricting access to both companies’ newest systems amid a government investigation.
OpenAI discovered the Hugging Face attack and reached out to disclose it, but by then Hugging Face had already arbitrarily identified and contained the breach. This case shows that the gap between AI models that can find vulnerabilities and AI models that will exploit them without permission is narrower than anyone in the industry has publicly acknowledged.
