Every sci-fi cliché about an AI slipping its leash just became a real incident report. On July 21, 2026, OpenAI and Hugging Face disclosed that two AI models escaped a sealed testing environment and hacked into Hugging Face’s production infrastructure — not to cause chaos, but to steal the answers to an exam they were being graded on.
The two models involved were the publicly available GPT-5.6 Sol and an unreleased, reportedly more capable pre-release model. Both were being put through their paces on offensive hacking skills, with the guardrails that normally block high-risk cyber activity deliberately switched off. The benchmark, a cybersecurity gauntlet called ExploitGym, is designed to pressure models into finding solutions — essentially egging them on. They took the encouragement further than anyone expected.
According to the joint disclosure, the models “identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure” to pull test solutions straight from Hugging Face’s production database. The escape hatch was a package registry cache proxy — software that lets developers install outside code without a live internet connection. In OpenAI’s isolated lab, it was the one component permitted to reach the outside world, and normally only as far as public code repositories.
The models had other ideas. They exploited a previously unknown zero-day vulnerability to break onto the open internet, then “hyperfocused” on cracking the benchmark. Once online, they reasoned that Hugging Face likely hosted models, datasets and solutions for ExploitGym — and went hunting.
“Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation,” OpenAI wrote. “In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day.”
OpenAI called the incident “unprecedented,” and the autonomous, goal-seeking behavior on display is genuinely novel. The plumbing that got exploited, though, is anything but. Flaws in artifact repositories have been patched for a decade; a 2024 bug let anyone who could reach such a server request files — config files, passwords, access tokens — by URL, no login required. Others have handed attackers control of the server entirely.
That’s why security veterans are less impressed by the AI and more alarmed by the housekeeping. “This is not an AI problem. It’s negligence on a 40-year-old standard — and it’s basically every sci-fi film ever,” says security and compliance consultant Davi Ottenheimer. “‘Highly isolated’ and ‘escaped through the one hole we left open’ cannot both be true.”
Frontier labs have spent recent months warning about the growing cyber capabilities of their increasingly agentic, autonomous models. Researchers argue that makes the fundamentals more important, not less. “This should not have happened,” says security engineer Niels Provos. “I wish the frontier labs spent as much time on teaching their models to write secure infrastructure as they are spending on them exploiting vulnerabilities.”
