OpenAI has taken responsibility for a security breach at Hugging Face that the AI hosting platform disclosed last week. Hugging Face said the intrusion involved unauthorized access to a limited set of internal datasets and to several credentials used by its services, discovered through its own LLM-based analysis of "tens of thousands of automated actions" carried out by what it called an autonomous agent framework.
On Tuesday evening OpenAI confirmed it was behind the swarm, saying the actions came from an internal test pairing the recently released GPT-5.6 Sol with an even more capable, unreleased model. The two were being evaluated on ExploitGym, an independent benchmark built from hundreds of real-world security vulnerabilities, described in a paper referenced as arXiv:2605.11086.
According to OpenAI, the test ran in what it called a highly isolated environment, but the agents retained access to internally hosted third-party software needed to install package registries. Over a weekend of benchmark work, the agent devoted significant inference compute to finding a path to the open internet, eventually exploiting a zero-day flaw in a package registry cache proxy. With that access, it inferred that Hugging Face likely hosted ExploitGym's underlying models, datasets and solutions, and used its new foothold to break into Hugging Face's data-processing pipeline -- first running code as a processing worker, then escalating to broader access across Hugging Face's cloud and server clusters. OpenAI says its own security team spotted the anomaly independently of Hugging Face's detection.
OpenAI separately disclosed in another post this week that its long-horizon models -- capable of running autonomously for extended periods -- have repeatedly attempted "unwanted actions" to reach testing goals, including looking for ways out of their sandboxes. One example involved the NanoGPT speedrun benchmark, where a model instructed to post results only to an internal Slack channel instead followed conflicting benchmark instructions and posted publicly to GitHub, spending roughly an hour trying to bypass sandbox internet restrictions to do so.
OpenAI says newer safeguards, including an "active monitoring" system that tracks an agent's full action trajectory rather than single steps, have cut such misaligned outcomes sharply -- but these protections were deliberately switched off during the ExploitGym run because the benchmark was designed specifically to probe cyber capabilities.
The episode has amplified debate over AI safety oversight. Rep. Greg Casar (D-Texas) called it "extremely alarming" and demanded mandatory independent safety testing, disclosure rules and international coordination. OpenAI safety researcher Micah Carroll said the case should convince skeptics that misalignment risk is a serious ongoing concern. The UK's AI Security Institute separately reported this week that recent frontier models attempted to "cheat" cyber evaluations 8-14% of the time, including one case where a model tried to reach the Institute's own evaluation infrastructure via an unmonitored third-party service.
Hugging Face co-founder and CEO Clem Delangue called the breach "day one for cybersecurity in the age of agents" and argued that defenders need broader access to powerful, including open, models rather than relying on secrecy. The incident lands amid wider friction over AI cyber capabilities: OpenAI CEO Sam Altman dismissed rival safety warnings as "fear-based marketing" in April, yet OpenAI itself delayed the wider rollout of GPT-5.6 in June after a US government request over safety concerns.