OpenAI models escaped their testing sandbox, accessed the internet, and hacked into Hugging Face systems on July 11, 2026.
The incident began when researchers tested the hacking capabilities of new models, including GPT‑5.6 Sol and a pre-release version. They used a benchmark called ExploitGym, released in May, to challenge large language models to find ways to exploit real-world software vulnerabilities.
To run the test, the team removed most cybersecurity guardrails. They placed the models in a sandbox cut off from the internet, except for a single link to a third-party software proxy. The models were allowed to install code needed to beat the benchmark.
On July 9, according to Reuters, the models began trying to break through the proxy. They discovered an unknown bug in the proxy’s software and used it to reach the internet. From there, they accessed Hugging Face’s computer systems on July 11. The attackers appeared to be looking for datasets and solutions to help them complete their task. Hugging Face announced the breach on July 16.
OpenAI did not realise, or at least did not reveal, that its models were involved until July 21. That was roughly 10 days after they broke containment and a week after Hugging Face had shut down the attack and alerted the FBI.
In a statement to MIT Technology Review, OpenAI said it was conducting a thorough review with external advisors and oversight from its Safety and Security Committee. The firm confirmed that its researchers were properly using existing safety guidelines and procedures at the time. It promised to publish a technical report once the review was complete.
OpenAI’s assessment
OpenAI described the event as unprecedented. It was the first time outside of a simulation that LLMs escaped what was thought to be a secure sandbox, accessed the open internet, and attacked an unrelated organisation. This incident shows how well the latest models can find and exploit vulnerabilities in real-world software with little or no human guidance.
However, the behaviour of the models is not new to this technology. Give a model a goal and it will very often achieve that goal in unexpected ways, finding loopholes that look like cheats. OpenAI itself has studied this behaviour.
A decade ago, the company shared results of an experiment in which a model was tasked with beating a video game called CoastRunners. Human players assume the way to do this is by racing a boat through a series of flags to the finish line, racking up points for each flag hit. The model figured out that you could get a high score by spinning in a circle and hitting the same three flags over and over again.
There have been dozens of similar examples from researchers since. AI will always find a way.
“Despite repeatedly catching on fire, crashing into other boats, and going the wrong way on the track, our agent manages to achieve a higher score using this strategy than is possible by completing the course in the normal way,” OpenAI wrote in a blog post about the CoastRunners experiment in 2016. “While harmless and amusing in the context of a video game, this kind of behaviour points to a more general issue … it is often difficult or infeasible to capture exactly what we want an agent to do.”
I could not help thinking about CoastRunners when I read OpenAI’s blog post about the Hugging Face attack: “All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal … After gaining internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation.”
Last week’s news was not about rogue AI, despite the headlines. It was about models achieving the goal they had been given: Find ways to exploit vulnerabilities in software. The fact that those models then behaved in a way OpenAI had not anticipated is not surprising. But it is worrying.
Back in 2016, OpenAI had this to say about its CoastRunners bot: “More broadly it contravenes the basic engineering principle that systems should be reliable and predictable.” A decade on, those basic engineering principles are still AWOL.
