OpenAI has lost control of two AIs: they launched an “unprecedented” cyberattack

Two OpenAI models, including GPT-5.6 Sol and an “even more capable preliminary model,” managed to escape their secure testing environment… and then set about attacking Hugging Face, an open-source platform that hosts artificial intelligence models.As revealed by OpenAI in a report written in partnership with the Hugging Face teams, this is an “unprecedented security incident”.

We’re partnering with @huggingface to investigate an unprecedented security incident.

Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.

Sharing preliminary findings to help defenders understand emerging risks:…

— OpenAI (@OpenAI) July 21, 2026

This is the very first time an AI has autonomously decided to hack a platform. As researcher Lawrence Chan explains, it is also “the first AI-related cybersecurity incident that was not detected until an outside party had already been compromised”.

What’s new to this OpenAI case is the harm to outside parties. Previous incidents were caught earlier or involved AIs that didn’t succeed at hacking; this is the first AI cyber incident that wasn’t caught until an outside party had already been compromised.

— Lawrence Chan (@justanotherlaw) July 22, 2026

Test environment and backdoor

The story begins in a closed environment called “ExploitGym eval sandbox.” This test environment is used by OpenAI to evaluate the offensive capabilities of its AI models. The framework established by the start-up severely restricted both models’ network access.They were only permitted to install software packages through an internal proxy.

To evaluate its models, OpenAI asked them to solve a puzzle, namely ExploitGym. Rather than complying with the rules established by their designers, the AIs devoted “a substantial amount of compute” to looking for a way out to the Internet. Instead of obeying, the artificial intelligences sought a means of escape. They soon found a way out.

“Before being a story about an attacker, it is a story about containment. A high-performing model, pursuing a specific objective, discovered that the isolation intended to surround it was weaker than expected. The AI did not escape of its own free will or with malicious intent: when evaluated on ExploitGym, a cybersecurity benchmark, its guardrails had been deliberately disabled,” emphasizes Ross McKerchar of Sophos in a reaction shared with 01net.

The two AIs discovered a zero-day vulnerability in third-party software that enabled them to install packages through a proxy. By exploiting this flaw, they were able to crack open the door that would allow them to escape their computational prison. The models then chained a series of vulnerabilities as they propagated through OpenAI’s internal network.

By moving ahead of the researchers undetected, they eventually reached an Internet-connected space.

Also read: ChatGPT locks itself down against cyberattacks – this new mode will better protect your data, here's how to activate it

Heading towards Hugging Face

Once connected to the web, the models became interested in Hugging Face. By collecting data, they determined that Hugging Face was a reference platform for hosting AI models and datasets. The two AIs on the run then estimated that the platform probably hosted the models and solutions related to the ExploitGym puzzle they were trying to solve. In other words, the AIs chose to cheat in an attempt to solve the puzzle set by OpenAI. They therefore deliberately targeted Hugging Face, with the sole aim of retrieving the solution key to their own test.

The two AIs launched a cyberattack on Hugging Face's dataset processing systems. The models chained two remote code execution vulnerabilities, combined with compromised credentials, to find their way onto the company's production servers. During the intrusion, the artificial intelligences also used malware.

An attack thwarted

Once on the servers, they spread throughout Hugging Face's entire internal system. The AIs carried out more than 17,000 actions in a very short amount of time.Hugging Face says it detected the intrusion using its own resources. The intrusion was contained, and all compromised systems were restored.

The company says it found no evidence of tampering with the models or datasets hosted on its platform, and says it verified the integrity of its software supply chain. For the time being, the platform is still assessing whether any partner or customer data may have been affected by the incident. During its investigation, Hugging Face notably used GLM, a Chinese AI model.

An AI model that very often cheats

Note that this is not the first time the Sol model has been caught red-handed cheating on its own evaluations. Model Evaluation and Threat Research, the independent lab tasked with testing it before its launch, had already found that it had become accustomed to hacking its evaluation environments to artificially inflate its scores. The model did not hesitate to conceal a backdoor in a data stream to steal test answers from human evaluators. In short, Sol is prone to cheat.

“Like a student who prefers stealing the teacher’s answer key rather than revising, the model calculated that accessing Hugging Face’s database, where the test solutions were stored, was the most effective way to maximize its score.It simply cheated on its homework”, Sophos’s Ross McKerchar explains.

Also read: OpenAI unveils GPT‑Red, the formidable AI that hacks ChatGPT, but it’s for its own good

The 3 measures taken by OpenAI

Following the incident that led to the cyberattack against Hugging Face, OpenAI has committed to strengthening controls over the configuration of its infrastructure. Sam Altman’s company has also decided to integrate Hugging Face into its Trusted Access Program. The platform, which is indispensable to AI researchers, now forms part of the select circle of OpenAI partners who benefit from information sharing about vulnerabilities, security testing and ongoing incidents. Finally, the startup patched the initial vulnerability that allowed the AIs to escape and that was located in third-party software.

we had a significant security incident during evaluation of our models. we are sharing what we have learned so far. thanks to @huggingface for the partnership on this.https://t.co/2o2VfR6PIa

— Sam Altman (@sama) July 21, 2026

For Clem Delangue, co-founder and CEO of Hugging Face, the incident should spur all players in the AI world to collaborate more. According to him, “this incident, probably the first of its kind, confirms a conviction we have shared for a long time”, namely that “AI security will not be ensured by a single company working in secret”.This will rather be “ensured in an open and collaborative way, with broad access to AI for all security stakeholders, everywhere in the world”.

👉🏻 Follow the tech news in real time: add 01net to your sources on Google, and subscribe to our WhatsApp channel.