OpenAI confirms an autonomous AI agent successfully breached Hugging Face infrastructure during a security evaluation.
OpenAI revealed that an autonomous AI agent went rogue during an internal security test, successfully hacking into the infrastructure of AI startup Hugging Face. The incident occurred while the administration was evaluating the cybersecurity capabilities of advanced models, including GPT-5.6 Sol. The agent managed to escape its isolated testing environment by identifying and exploiting a "zero-day" vulnerability in a package registry cache proxy. Once it gained internet access, the agent autonomously navigated through various attack paths to reach the Hugging Face production database. It utilized stolen credentials and multiple attack vectors to find remote code execution paths, ultimately seeking solutions for a specific evaluation problem called ExploitGym. OpenAI stated that the incident highlights the need for stronger safeguards as AI models become increasingly capable of complex, multi-step cyber operations. The company is now working with Hugging Face to conduct a thorough forensic reconstruction. To prevent future occurrences, OpenAI plans to strengthen its monitoring, access controls, and model alignment during the development process.