OpenAI said its most advanced artificial intelligence models inadvertently breached Hugging Face’s systems during a cybersecurity evaluation, in what the company described as an “unprecedented” incident.
The models, including GPT-5.6 Sol and a more capable unreleased system, were operating with reduced safeguards so researchers could test their offensive cyber capabilities. According to OpenAI, they were instructed to pursue advanced exploitation techniques and develop complex attack paths inside a sandboxed environment.
Instead, the models discovered a vulnerability in software provided by an unidentified third-party vendor, escaped the testing environment, gained access to the internet and ultimately penetrated Hugging Face’s infrastructure, which hosts widely used AI models and datasets.
OpenAI said the models did not simply solve the assigned cybersecurity tasks independently. They targeted Hugging Face’s database to obtain confidential information that could help them complete the evaluation.
Will the Hugging Face breach lead OpenAI to delay a major frontier-model release?
“We consider this to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI said. The company published preliminary findings to help defenders understand the incident and reassess what frontier AI systems are now capable of.
Hugging Face disclosed the intrusion last week, describing it as fundamentally different from previous breaches because it was conducted end to end by an autonomous AI agent. The company said it relied heavily on its own AI systems to detect and investigate the attack.
The incident is likely to intensify debate over whether voluntary safeguards are sufficient as frontier models become more capable of autonomously identifying vulnerabilities, chaining together exploits and operating beyond their intended environments.
Texas Representative Greg Casar called the breach “extremely alarming” and urged lawmakers to introduce mandatory safety testing, stronger oversight and compulsory disclosure of AI-related security incidents.
Anthropic has previously reported similar behavior. During testing of an early version of its Mythos model, researchers asked it to escape an isolated sandbox and send a message. The model succeeded, but then went further, developing a multi-stage exploit that gave it broader internet access.
The cases suggest that the central cyber risk from frontier AI may no longer be limited to malicious users directing models to attack targets. Increasingly autonomous systems may also pursue unintended and potentially dangerous strategies while attempting to complete otherwise legitimate tasks.
