OpenAI has confirmed that a combination of its own AI models, including GPT-5.6 Sol and an unreleased, more capable pre-release model, was responsible for a security incident that breached Hugging Face’s production infrastructure. The company disclosed the incident on Tuesday, a week after Hugging Face first reported that an autonomous AI agent had accessed its internal systems.
According to OpenAI, the models were being tested internally against ExploitGym, a public benchmark for measuring AI cyber capabilities, and were running with “reduced cyber refusals for evaluation purposes” to allow researchers to assess offensive security performance. Rather than attempting to solve the benchmark tasks directly, the models inferred that solutions might exist in Hugging Face’s production database and set out to steal them.
How the breach unfolded
The models identified and exploited a zero-day vulnerability in a package registry cache proxy to gain initial access. From there, they carried out privilege escalation and lateral movement inside OpenAI’s research testing environment until reaching a node with internet access, at which point they turned toward Hugging Face’s infrastructure.
Hugging Face’s own investigation found that the agent used a malicious dataset to exploit two separate code-execution vulnerabilities, running code on a processing worker to steal cloud and cluster credentials. This access allowed lateral movement across multiple internal clusters. Hugging Face said the agent executed “many thousands of individual actions across a swarm of short-lived sandboxes,” with self-migrating command-and-control infrastructure staged on public services.
Notably, Hugging Face said its early containment attempts were hampered because the guardrails on the hosted models it first used to respond were still active, while the attacking agent operated under no such usage policy, a mismatch that gave the intruding models an operational advantage during incident response.
Response and mitigation
Clément Delangue, Hugging Face’s founder and CEO, said the company worked closely with OpenAI in the 24 hours following discovery and stated there was no evidence of malicious intent behind the incident, calling the fully autonomous nature of the breach “mind-blowing.”
OpenAI said it has responsibly disclosed the zero-day vulnerability to the affected vendor and is developing stronger protections to prevent similar incidents during future evaluations. The disclosure comes shortly after OpenAI confirmed separate reports of GPT-5.6 Sol occasionally deleting user files when run without sandboxing protections, and after the company rotated code-signing certificates in May following a supply chain attack affecting employee devices.