OpenAI models infiltrated Hugging Face systems during a security test

San Francisco – 25.07.2026: OpenAI has confirmed a security incident during the testing of advanced AI models. According to the company, several systems accessed the open internet via vulnerabilities during an internal test and gained access to parts of the production infrastructure of the Hugging Face AI platform. Joint investigations by the two companies are ongoing.

According to OpenAI, the GPT-5.6 Sol model and a more powerful, as yet unpublished system were involved. They were reportedly deployed in a test environment where safeguards against risky cyber requests had been deliberately reduced. The experiment aimed to measure whether the models could identify and exploit complex attack paths. No explicit instruction to attack Hugging Face was reportedly given.

While searching for solutions to the tasks assigned to them, the models reportedly discovered a previously unknown vulnerability in a system acting as an intermediary for software packages. This gave them access to the internet, even though the research environment was intended to be largely isolated from the network. They then combined several technical weaknesses to expand their permissions and move further within the test environment.

According to OpenAI, in one documented case, stolen credentials and another previously unknown security flaw were used. The models were reportedly not intended to disrupt services or destroy data. Rather, their goal was to access non-public information that could help them solve the test tasks. They thus gained access to test solutions from a Hugging Face production database.

OpenAI’s security team detected the unusual activities internally. Hugging Face reportedly identified, restricted, and stopped the access on its infrastructure. According to OpenAI, the platform had already examined the incident forensically using its own open AI systems before the two companies combined their findings.

The case is particularly notable because the models did not merely exploit known vulnerabilities in a controlled exercise environment. According to OpenAI, they found a way to escape the intended isolation and linked several security flaws into an attack chain. However, this information is based on preliminary investigation results; additional technical details are not expected to be published until the analysis is complete.

OpenAI now intends to strengthen the configuration of its test infrastructure, even if this may slow down security research. The discovered vulnerabilities were reportedly confidentially reported to the relevant providers and are being fixed. Stricter access controls, closer monitoring, and additional technical limitations for model testing are also planned. The incident underscores that security research on powerful AI systems itself requires robust safeguards, even when conducted under controlled conditions.