OpenAI model breaks into Hugging Face system during security test

San Francisco – July 25, 2026: OpenAI confirmed a security incident that occurred during the testing of advanced AI models. According to the company, several systems accessed the public internet through vulnerabilities during internal testing and gained access to parts of the operational infrastructure of the AI platform Hugging Face. Both companies are continuing a joint investigation.

According to OpenAI, the systems involved were the GPT-5.6 Sol model and a more powerful system that has not yet been released. They were operated in a test environment where protective guidelines for dangerous cyber requests had been deliberately relaxed. The experiment was intended to measure whether the models could identify and exploit complex attack paths. There had reportedly been no explicit instruction to attack Hugging Face.

While seeking solutions to the assigned tasks, the models reportedly discovered a previously unknown vulnerability in a system that acts as an intermediary for software packages. This enabled them to access the internet, even though the research environment was generally supposed to be isolated from the network. They then combined several technical weaknesses to escalate privileges and move further within the test environment.

According to OpenAI, one documented case involved compromised access credentials and another unknown security vulnerability. The models were designed not to disrupt services or destroy data. Instead, the goal was reportedly to access non-public information that could help solve the test tasks. In the process, they accessed test answers in Hugging Face’s operational database.

OpenAI’s security team internally detected unusual activity. Hugging Face detected, restricted, and stopped the access on its infrastructure. According to OpenAI’s account, the platform had already conducted a forensic investigation of the incident using its own open AI system before the two companies consolidated their findings.

The incident is particularly noteworthy because the models did not merely exploit known vulnerabilities in a controlled training environment. According to OpenAI, they found a path out of the intended isolation and linked several security vulnerabilities into a single attack chain. However, this information is based on preliminary investigation findings, and more detailed technical information is expected to be released only after the analysis is complete.

OpenAI now plans to strengthen the configuration of its testing infrastructure, even if this may delay security research. The discovered vulnerabilities have been reported privately to the affected providers and are expected to be addressed. Stricter access controls, closer monitoring, and additional technical restrictions for model testing are also planned. The incident underscores that security research involving powerful AI systems requires robust safeguards even when conducted under controlled conditions.