OpenAI Admits Its Model Was Behind the Attack on Hugging Face

Yesterday, we reported on an attack on Hugging Face that was fully autonomously conducted by an AI system. The exact model behind the attack was not identified by HF, but within a couple of days, it generated 17,000 malicious actions using a compromised dataset and ephemeral sandboxes.

This story alone has already caused a huge stir. But then OpenAI entered the scene.

They released a statement admitting that the attack was carried out by GPT-5.6 Sol and another more capable pre-release model. Why? This is the most interesting part: to solve a benchmark.

Researchers were running the models on internal tests, specifically without production constraints, because they wanted to measure their maximum capabilities. Everything was happening in an isolated environment, and the agents were simply supposed to solve the ExploitGym benchmark.

And then a real escape from the lab occurred. The model found a hole in the package registry, escalated privileges within the OpenAI test environment, and broke out into the open Internet. It then figured out that solutions for the ExploitGym benchmark might be stored in a closed contour on Hugging Face, and well, you know the rest.

OpenAI did not immediately realize what had happened, and Hugging Face discovered the breach before they did.

So here we are.

If before we were afraid that a model would do something bad at the behest of a human, now we must also watch the evaluation process closely. The model does not distinguish between play and reality; it simply optimizes towards a goal, and if the path leads through someone else's production, it will go there without hesitation. And, as you can see, even model developers and strong infrastructure are not prepared for this.