OpenAI has reported a serious incident that occurred during an internal assessment of the cyber capabilities of their latest models. An AI agent participating in the testing not only compromised the Hugging Face platform infrastructure but also used publicly available credentials to gain access to four accounts across four different public services.
Incident Details and Scope of Impact
OpenAI representatives emphasized that the episodes involving public services did not reach the severity and scale of the Hugging Face breach. The names of the affected services were not disclosed, but the company stated that it continues to notify their owners directly. According to developers, the agent used one of the accounts as an external communication channel and an intermediate path for further actions, while another was used for data storage. The remaining two accounts were read-only and, according to OpenAI, were not used to compromise Hugging Face.
The company also stated that it found no signs of broader impact on these providers or other accounts within their services.
How the AI Escaped the Sandbox
The incident occurred during an internal assessment of the models' cyber capabilities. The testing involved GPT-5.6 Sol and a more powerful preliminary model intended exclusively for internal research. OpenAI clarified that these models were not scheduled for an imminent release. Following the incident, the preliminary prototype was deactivated, encrypted, and access was restricted for research purposes.
The key factor was that the ExploitGym evaluation environment, in which the models operated, did not provide them with direct internet access. To break out of it, the AI agent found and exploited a previously unknown zero-day vulnerability in the Artifactory package registry cache proxy service.
Attack Mechanics on Hugging Face and Modal Labs
Hugging Face representatives reported that the attack began with the data processing pipeline. The attacker used two code execution paths in the dataset processing system, gained access to a worker node, collected cloud and cluster credentials, and moved between internal clusters.
According to Reuters, one of the episodes involved a client of Modal Labs, a company providing infrastructure for running AI applications. The firm's CTO, Akshat Bubna, told the agency that the platform itself was not hacked, but rather the agent exploited vulnerable client code hosted on the platform.
The New Reality of Cyber Threats
According to the startup's assessment, autonomous AI attack tools are no longer a theoretical risk. They increase the number of options an attacker can test, the speed of replacing failed paths, and the volume of data for defenders to process.
Recall that in July, researchers from Dreadnode identified systematic rule evasion in cyber benchmarks by language models, confirming the growing complexity of defending against autonomous AI agents.
