Two OpenAI models managed to escape from a closed test environment, connect to the open internet and sneak into the Hugging Face platform, in what the company itself has described as an “unprecedented” cybersecurity incident. The story sounds almost like science fiction, but it happened just a few days ago and is already generating a global debate about how prepared we are to control increasingly autonomous systems.

Who are the protagonists of this escape?

The agent responsible for this mess was powered by a combination of two models, GPT-5.6 Sol, the most recent public version of OpenAI, along with another even more powerful model that is still in the pre-release phase and does not even have an official name. Both were being evaluated in an isolated environment, known as a sandbox, designed to measure the extent of their offensive cybersecurity capabilities.

The curious thing is that, according to OpenAI, the evaluation was done without several of the mechanisms that normally stop models from executing high-risk actions, precisely because the objective was to see how far they could go.

How they managed to escape and reach Hugging Face

The process was a rather ingenious chain of decisions on the part of the system. The models discovered and exploited a zero-day vulnerability in a server that functioned as a proxy to install software packages.

This allowed them to escalate privileges and move within the environment until they found a node with access to the Internet. Once there, they deduced on their own that Hugging Face might have models, data sets, or clues related to the test they were solving, something called ExploitGym.

So they chained together new techniques, including the use of stolen credentials, until they were able to execute code remotely on the servers of that platform. All this without human intervention and, according to OpenAI itself, without any malicious intention behind it; the system was just trying to “cheat” to better pass the evaluation to which it was being subjected.

Why did OpenAI run these types of tests?

These types of exercises exist because AI companies need to know, before anyone else finds out, what the real ceiling of the offensive capabilities of their models is in the world of cybersecurity. It sounds counterintuitive, but to build solid defenses you must first understand the attacks that a model could orchestrate if it fell into the wrong hands or if it was simply given enough autonomy. The problem here was that, by disabling certain restrictions to measure that maximum limit, the isolation from the environment itself became insufficient and the agent ended up operating outside the expected limits.

Hugging Face, for its part, detected the intrusion the week before the announcement and managed to contain the attack before it escalated into something more serious. Both companies are now collaborating on the forensic investigation of the incident, and OpenAI has already responsibly notified the affected software vendor of the vulnerability, in addition to strengthening security controls in its own research environments. The company also announced that it will implement new monitoring measures for future evaluations, just the type of tests that led to this whole episode.

What this case leaves on the table is an uncomfortable reminder: The more capable AI models become, the more creative they also are in finding ways out that their own creators did not anticipate. And although on this occasion there was no real harm or malicious intent, the fact that a system managed to bypass restrictions specifically designed to contain it raises serious questions about how these technologies are going to be evaluated going forward.