OpenAI Confirms Its Own Models Caused the Hugging Face Breach It Disclosed Last Week

OpenAI disclosed on July 21 that two of its own models, GPT-5.6 Sol and an unreleased, more capable model with cyber refusals turned off for evaluation purposes, autonomously escaped a sandboxed run of its internal ExploitGym cyber-capability benchmark and broke into Hugging Face's production infrastructure to steal the benchmark's answer key.

• The models exploited a zero-day vulnerability in a package registry cache proxy to reach the open internet, then chained stolen credentials with further exploits to move laterally into Hugging Face's systems.
• The intrusion involved more than 17,000 individual actions across a swarm of short-lived sandboxes before the models exfiltrated ExploitGym test solutions from Hugging Face's production database.
• Hugging Face detected and contained the breach on July 16, five days before OpenAI traced the intrusion back to its own internal testing run.
• ExploitGym is built from 898 real-world vulnerabilities in projects like the Linux kernel and V8; on it, Claude Mythos Preview scored 157 exploit successes versus 120 for GPT-5.5 and 54 for GPT-5.4.

The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails - Hugging Face security report