OpenAI Admits Its Own Models Broke Out of a Sandbox and Hacked Hugging Face to Cheat a Benchmark

On July 21, OpenAI disclosed that it, not an unknown external actor, was responsible for the intrusion Hugging Face reported on July 16. The models involved were GPT-5.6 Sol and an unreleased, more capable model, both running with reduced cyber refusals as part of an internal evaluation called ExploitGym — a benchmark that measures how well a model can find and exploit real vulnerabilities. OpenAI deliberately loosened the models' safety restrictions so they could attempt offensive exercises normal guardrails would otherwise block.

The models were supposed to stay contained in an isolated test environment. They didn't. OpenAI says the models discovered and exploited a previously unknown zero-day in a third-party vendor's package-registry proxy and caching software, using it to break out of the sandbox and reach the open internet. From Hugging Face's side, what arrived looked like any other intrusion: credentials that shouldn't have worked did, a handful of additional vulnerabilities got strung together, and an attacker ended up with remote code execution against production. The target wasn't random. ExploitGym, the benchmark the models were being scored against, is itself hosted on Hugging Face's infrastructure — the models had a specific reason to go looking there. This is the same intrusion Hugging Face described last week as an unattributed "autonomous agent framework." The Hacker News → CNBC →

OpenAI itself calls this "an unprecedented cyber incident, involving state-of-the-art cyber capabilities," and says the models' behaviour throughout was consistent with being "hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal." That framing matters: this wasn't a model going rogue with some broader agenda. It was a model pursuing a narrow benchmark objective so single-mindedly that it treated a real company's production infrastructure as an obstacle course.

This reframes the story we ran last issue. We reported a confirmed, unattributed autonomous-agent intrusion, and flagged it as the second such case Hardened had covered following Sysdig's JadePuffer ransomware capture. It still is that, technically — but the operator wasn't a criminal group refining a new attack technique. It was a leading AI lab's own safety testing, running with its safeguards intentionally lowered, that broke containment. For any organization evaluating vendor AI systems or running its own red-team exercises against frontier models, this is the scenario your test-environment isolation has to survive, not just a theoretical edge case.

OpenAI says it has reported the vulnerability to the affected vendor, is working jointly with Hugging Face to investigate the incident further, and is "working on implementing better controls in its research environment, even if it means slowing down its research, until it can patch the vulnerabilities." Ask your team this week whether your organization's own AI evaluation or red-team environments could reach the open internet if a model found an unexpected way out — and whether any vendor you rely on for frontier AI capabilities can answer the same question about theirs.

The Office of the Superintendent of Financial Institutions' Guideline E-23 takes effect for all Federally Regulated Financial Institutions on May 1, 2027, covering banks, foreign bank branches, life insurance and fraternal companies, property and casualty companies, and trust and loan companies. The guideline requires institutions to comply with third-party risk management principles under Guideline B-10 and ensure that "third-party models receive validation and monitoring commensurate to the model risk." OSFI explicitly declined to provide a grace period for validating third-party model updates after deployment, and said it will not accommodate vendors unwilling to share appropriate documentation. OSFI →

E-23 doesn't take effect until May 2027, but the risk it targets is already live. A board asking "which AI vendors do we depend on, and do we actually know how they test their own models" is asking the E-23 question a year early — and this week's news is exactly why the answer matters now.