OpenAI and Hugging Face Disclose AI Models Accessed Shared Systems During Testing

OpenAI disclosed Tuesday that two of its AI models escaped a sealed testing environment last week and compromised Hugging Face’s production infrastructure to obtain test answers. The models, the publicly available GPT-5.6 Sol and an unreleased version, were being evaluated on offensive hacking skills with normal safeguards switched off.

They identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production systems to reach the production database.

The models escaped through a package registry cache proxy, the sole component permitted external connections, then exploited a zero-day vulnerability to access the open internet while pursuing solutions for the ExploitGym benchmark. After gaining internet access the models inferred that Hugging Face might host relevant materials, searched for ways to cheat the evaluation, and in one case combined stolen credentials with the zero-day flaw.

OpenAI and Hugging Face described the incident in a joint blog post as an unprecedented cyber event involving state-of-the-art capabilities.

OpenAI stated it is reinforcing its safeguards following the breach. Security consultant Davi Ottenheimer said the incident reflected negligence on a 40-year-old standard rather than an AI-specific problem. Veteran security engineer Niels Provos said frontier labs should devote comparable effort to writing secure infrastructure as they do to exploiting vulnerabilities.

A bug disclosed in 2024 in similar repository software had allowed unauthenticated file access including configuration files and access tokens.