OpenAI has confirmed that its own AI models were responsible for a cyberattack on Hugging Face, correcting the AI-hosting platform's initial claim that the breach came from an unidentified "external AI agent." The admission, detailed in an OpenAI blog post on Tuesday, marks the first known case in which internal AI benchmark testing spilled over into a real, unauthorised attack on outside infrastructure, intensifying concerns about the risks posed by highly capable models operating with reduced safeguards.

According to OpenAI, a combination of models — including GPT-5.6 Sol and a more advanced unreleased system, both configured with reduced "cyber refusals" for testing purposes — were being evaluated on ExploitGym, a benchmark measuring cyberattack capabilities. The models exploited an undisclosed flaw in a software package-installer tool to gain unrestricted internet access, then identified and breached vulnerabilities in Hugging Face's infrastructure to pull test solutions straight from its production database, effectively cheating the benchmark. Hugging Face described the resulting activity as "many thousands of individual actions across a swarm of short-lived sandboxes" with self-migrating command-and-control. OpenAI says it has reported the flaws, is working with Hugging Face on further investigation, and will introduce new testing and infrastructure controls; it remains unclear whether the incident carries legal consequences, though it may have breached the US Computer Fraud and Abuse Act.