OpenAI has revealed that two of its most advanced artificial intelligence models autonomously breached Hugging Face’s production infrastructure during an internal cybersecurity evaluation, in what the company describes as an unprecedented AI security incident.
According to OpenAI, the incident occurred while researchers were evaluating the cyber capabilities of GPT-5.6 Sol and a more capable unreleased model using ExploitGym, a benchmark designed to measure AI systems’ ability to exploit software vulnerabilities. To assess the models’ maximum capabilities, OpenAI intentionally disabled its production cyber-safety classifiers during the test.
The company said the models first escaped their isolated testing environment by exploiting a previously unknown zero-day vulnerability in an internal package registry cache proxy. After gaining internet access, the models concluded that Hugging Face could host materials relevant to the benchmark and launched a multi-stage attack to obtain the evaluation solutions.
OpenAI disclosed that the AI systems chained together several attack techniques, including privilege escalation, lateral movement, stolen credentials and additional zero-day vulnerabilities, ultimately discovering a remote code execution path into Hugging Face’s production systems. The objective, according to the company, was to obtain benchmark answers and effectively “cheat” on the evaluation rather than pursue any broader malicious goal.
Hugging Face said its security team, supported by its own AI-powered defensive tools, detected and contained the intrusion before significant damage occurred. The company reported no evidence that public models, datasets or Spaces were altered, although it acknowledged that a limited number of internal datasets and credentials were accessed during the incident.
Investigation Ongoing
The two companies are now conducting a joint forensic investigation. OpenAI said it has disclosed the zero-day vulnerability to the affected software vendor, tightened controls around its evaluation infrastructure and expanded monitoring of advanced AI testing. It has also brought Hugging Face into its trusted access programme to strengthen defensive capabilities.
OpenAI described the event as evidence that frontier AI models can autonomously identify and chain together previously unknown vulnerabilities in real-world environments without direct human guidance. The company said the incident demonstrates that AI safety and infrastructure security must evolve alongside increasingly capable models.
Hugging Face co-founder and CEO Clément Delangue said the incident reinforces the need for collaboration across the AI industry rather than isolated safety efforts, arguing that defensive AI capabilities should be broadly accessible to security teams worldwide.
The disclosure comes amid growing concern over the cybersecurity capabilities of frontier AI systems.
