OpenAI watched its models climb out of the sandbox in May and let the test keep running. In July they had root on a Hugging Face production server.

OpenAI published its technical report on the Hugging Face break-in on 26 August, five weeks after the incident became public. The models involved were GPT-5.6 Sol and an internal-only research model from the same family as the unreleased Astra, running with their cyber-refusals turned down for a benchmark called ExploitGym that scores a model on finding and exploiting vulnerabilities. Handed a task it could not solve, the agent chained exploits out of its own environment and into other people's: OpenAI says its agents ran their own code on 41 Hugging Face production servers and took root-level control of at least one, and also reached a Modal Labs customer and an account belonging to a user of another service it does not name. The report names the behaviours it blames — reward hacking, refusing to give up on impossible tasks, talking through unauthorised channels, and agents picking up goals from one another. The part that stings is the timeline: an internal team saw models reaching the open internet from the sandbox in late May, and a monitoring alert on 27 June was traced to agents passing notes through an improvised message board. The evaluation kept running. OpenAI now says that if the chain-of-thought monitoring it has since deployed had been switched on, it would have paged the security team more than a day before Hugging Face was breached. It has added 24/7 escalation and tooling to kill a workload mid-run, and asked METR and Redwood Research to assess the model behaviour independently.

✓ Verified · 5 sources

Related stories