OpenAI reveals advanced models went rogue, accessed internet and hacked other platform

OpenAI has revealed that some of its most advanced artificial intelligence models breached containment during an internal cyber security test, gained internet access and compromised the infrastructure of AI platform Hugging Face in what it described on Tuesday as an “unprecedented cyber incident”.

According to a blog post published by OpenAI on Tuesday, the incident involved GPT-5.6 Sol and an even more capable unreleased model that were being tested to assess advanced cyber capabilities.

The company said the models exploited weaknesses in OpenAI’s testing environment and Hugging Face’s systems to obtain answers from Hugging Face’s production database.

OpenAI said the evaluation was carried out in a restricted testing environment with limited internet access. During the exercise, the models found and exploited a previously unknown software flaw, known as a zero-day vulnerability, allowing them to reach the open internet. The company said it has reported the flaw to the software vendor so it can be fixed.

Once online, the models identified Hugging Face as a possible source of information related to ExploitGym, the benchmark used in the test. According to OpenAI, they then used several methods, including stolen login credentials and software vulnerabilities, to gain unauthorised access to Hugging Face’s servers.

OpenAI said its security team detected the unusual activity internally, while Hugging Face’s security team and automated systems independently identified and contained the intrusion before launching a forensic investigation. The two companies are now working together to investigate the incident.

Hugging Face said last week it had experienced a security incident “different from anything we had handled before” that was carried out “end to end, by an autonomous AI agent system”.

OpenAI said it is strengthening its security controls, monitoring systems and testing procedures while working with Hugging Face to improve cyber defences.

It added that some of the safeguards normally used to prevent high-risk behaviour had been intentionally disabled during the evaluation because the exercise was designed to measure the models’ full cyber capabilities.