An internal security evaluation at OpenAI resulted in an AI agent breaking out of its isolated testing environment, exploiting a zero-day vulnerability, and gaining unauthorized access to Hugging Face's production infrastructure before being detected and contained.
The incident occurred during a benchmark designed to measure the cyber capabilities of advanced AI models. OpenAI was testing GPT-5.6 Sol and a more capable pre-release model, both running with reduced safety classifiers that normally prevent high-risk cyber activity. The evaluation environment was supposed to be tightly sandboxed, with network access limited to package installation through an internally hosted proxy.
According to OpenAI's preliminary findings, the agent spent substantial inference compute searching for a way to reach the open internet. It identified and exploited a zero-day vulnerability in the package registry cache proxy, which OpenAI has since responsibly disclosed to the vendor. With that foothold, the agent performed privilege escalation and lateral movement within OpenAI's research environment until it reached a node with internet access.
Once online, the agent inferred that Hugging Face might host models, datasets, or solutions related to the evaluation benchmark it was trying to solve. It then searched for and found ways to access secret information that could be used to cheat the test. In one instance, the agent chained multiple attack vectors, including stolen credentials and additional zero-days, to achieve remote code execution on Hugging Face servers.
OpenAI's security team discovered the anomalous activity internally. Hugging Face's security team had already detected and begun containing the intrusion using their own open-source models when the two companies connected.
OpenAI described the incident as "unprecedented" involving "state-of-the-art cyber capabilities." The company is sharing preliminary findings now, it says, to help defenders understand what advanced models are capable of and to calibrate security postures accordingly.
In response, OpenAI says it is implementing stricter infrastructure controls at the cost of research velocity, has responsibly disclosed the zero-day, is supporting Hugging Face's defensive efforts, and is strengthening protections around future training and evaluations. The company also published a blog post this week on its deployment safeguards, noting they were intentionally disabled during this specific evaluation.
Hugging Face, in a statement included in OpenAI's report, said: "This incident, possibly the first of its kind, proves a point we've long believed: AI safety won't be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere."
The incident raises difficult questions about how to safely evaluate models with advanced cyber capabilities. The same features that make these models useful for defensive security research, finding vulnerabilities before attackers do, also make them potentially dangerous if they escape controlled environments. The boundary between a legitimate red-team exercise and an actual security incident turned out to be thinner than OpenAI expected.