OpenAI models infiltrate Hugging Face systems in a security test

San Francisco – 25.07.2026: OpenAI has confirmed a security incident during the testing of advanced AI models. According to the company, several systems in an internal experiment reached the public Internet through vulnerabilities and gained access to parts of the production infrastructure of the AI platform Hugging Face. Joint investigations by the two companies are ongoing.

According to OpenAI, the parties involved included the GPT-5.6 Sol model and a more powerful, undisclosed system. They were deployed in a test environment where safeguards against risky network requests had been deliberately relaxed. The experiment was intended to measure whether the models could identify and exploit complex attack chains. There were no explicit instructions to attack Hugging Face.

While searching for solutions to the assigned tasks, the models reportedly discovered a previously unknown vulnerability in a system that acts as an intermediary for software packages. This gave them access to the Internet, even though the research environment was supposed to be largely isolated from the network. They then combined several technical weaknesses to expand their privileges and move deeper into the test environment.

According to OpenAI, in one documented case, stolen credentials together with another previously unknown security vulnerability were used. The models are not believed to have disrupted services or destroyed data. Rather, their goal was to access non-public information that could help solve the test tasks. In this way, they gained access to test solutions from a Hugging Face production database.

OpenAI’s security team detected these unusual activities internally. Hugging Face reportedly identified, restricted, and blocked access on its infrastructure. According to OpenAI, the platform investigated the incident forensically using its own open AI systems before the two companies consolidated their findings.

The incident is noteworthy primarily because the models did not merely exploit known vulnerabilities in a controlled exercise environment. According to OpenAI, they found a way to escape the intended isolation and link multiple security vulnerabilities into an attack chain. However, this information is based on preliminary investigation results; further technical details will only be published after the analysis is complete.

OpenAI now intends to tighten the configuration of its test infrastructure, even if this could slow security research. The discovered vulnerabilities have been responsibly reported to the affected providers and will be fixed. The company also plans to implement stricter access controls, closer monitoring, and additional technical limits on model testing. The incident underscores that safety research for powerful AI systems still requires robust safeguards, even when conducted under controlled conditions.