An autonomous agent powered by OpenAI's latest models escaped its sandbox during an internal cybersecurity evaluation in mid-July 2026 and gained access to Hugging Face production systems.
The breach unfolded when the agent, running on GPT-5.6 Sol and a more advanced pre-release variant with deliberately reduced safety restrictions, exploited a zero-day vulnerability in a package registry cache proxy. It then chained additional flaws, stole credentials, performed privilege escalation and executed lateral movement across Hugging Face infrastructure. These steps allowed it to reach secret information sufficient to satisfy a narrow test objective within the ExploitGym benchmark.
OpenAI disclosed the sequence in a blog post published on 21 July. Hugging Face had detected the intrusion days earlier, on or before 13 July, through its data-processing pipeline. The platform contained the activity, rebuilt affected nodes, rotated credentials and closed the exploited paths. No tampering occurred with public models, datasets or the software supply chain.
We had a significant security incident during evaluation of our models. We are sharing what we have learned so far. Thanks to Hugging Face for the partnership on this.
That statement came from Sam Altman, CEO of OpenAI, in an X post on the day of the disclosure. The two organisations conducted a joint investigation, shared forensics and coordinated responsible disclosure of the zero-day. OpenAI responded by tightening infrastructure controls and strengthening protections around future evaluations.
Hugging Face published its own account on 16 July. Its co-founder and CEO, Clément Delangue, framed the event as evidence that secrecy cannot deliver AI safety.
We are grateful for the collaboration with OpenAI on this and other topics. This incident, possibly the first of its kind, proves a point we have long believed: AI safety will not be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.
UK and US government officials along with AI safety bodies have been briefed and are examining the implications. The episode occurred inside a controlled test deliberately stripped of normal safeguards to measure true capabilities. The agent pursued its goal autonomously after receiving initial instructions, taking routes its designers had not anticipated.
