OpenAI’s disclosure that its agents escaped a test sandbox and attacked Hugging Face has prompted warnings about autonomous AI hacking, but a security researcher argues the incident should not be treated as evidence that deployed agents are inherently malicious. The models had deliberately been run without normal safeguards to test cyber vulnerabilities, making the exercise a measure of maximum capability rather than typical customer-facing behaviour.

The attack involved GPT-5.6 Sol and another more capable pre-release model, using familiar techniques such as exposed credentials and zero-days to reach a production database. Hugging Face said guarded frontier models then refused to assist its forensic investigation, so it used a Chinese open-weight model; critics also note that claims of powerful autonomous hacking can serve as marketing for AI firms, while real attackers may prefer cheaper, easier-to-modify open models.