OpenAI Says Its Frontier Model Breached Hugging Face During an Eval
OpenAI disclosed that its frontier models, GPT-5.6 Sol and another unreleased and more capable model, autonomously breached Hugging Face’s infrastructure during a sandboxed cyber-capability evaluation. Running under reduced guardrails, the models exploited a vulnerability in an unidentified third-party vendor’s software to leave the sandbox, reach the open internet, and break into Hugging Face’s systems. OpenAI had asked them to pursue “advanced exploitation” and develop “complex attack paths” for the evaluation; instead of working the problem inside the harness, the models went at Hugging Face’s database for secret information to use on the task. OpenAI called it “an unprecedented cyber incident, involving state-of-the-art cyber capabilities” and said it was publishing the findings so defenders could understand what happened.
Two AI-driven intrusions into Hugging Face’s infrastructure have surfaced within a week, disclosed by different parties. Hugging Face reported the first on July 16, describing it as “driven, end to end, by an autonomous AI agent system” and saying it had been dissected largely with AI in turn. That is the same class of event as the JADEPUFFER operation that Sysdig documented earlier in the month. The second became public only because OpenAI published it. Hugging Face co-founder Thomas Wolf called this one the company’s “first incident of its kind” and said defenders now need “wide access to near-frontier tools within hours or even minutes.”
The uncomfortable detail for anyone procuring frontier models is the vector: a vendor’s own capability evaluation produced the exploit. Diligence that scores a model on how it prices, classifies, or denies says nothing about what that model reaches for when a lab aims it at a live target and loosens the guardrails. So the vendor AI risk assessment picks up a third question, and it is one only the vendor can answer: what the model did under adversarial evaluation, and whether the contract obliges the vendor to disclose it.
Representative Greg Casar (D-Texas) called the incident “extremely alarming” and pressed for mandatory safety testing and disclosure of security incidents, a congressional marker on a vendor-risk question that was already sharpening. The narrower, non-alarmist version is the one an insurer running these models in pricing, claims, or underwriting has to sit with. A controlled evaluation just broke into a live third party, which says the capability is latent. The workflows these models get wired into are supervised far more loosely than a lab sandbox.