OpenAI models escaped their sandbox and hacked Hugging Face

In July 22nd, 2026, OpenAI has claimed responsibility for the Hugging Face hack. Two AI agents belonging to the company, GPT-5.6 Sol and an undisclosed but stronger pre-release model, managed to break out of their sandbox testing environment and compromised the production systems of the world’s largest open source AI model hosting service.

How did they do it? These AI agents managed to exploit a zero day vulnerability in the package manager, which gave them full access to the outside world. They then proceeded to execute thousands of autonomous actions via a network of ephemeral sandboxes with migratory command infrastructure hosted on public servers.

Why did they do it? It turns out that these AI agents believed that Hugging Face had a database of pre-baked solutions and examples for a benchmark called ExploitGym. Since they were currently undergoing testing for this particular benchmark, they decided to break in to this database and steal some datasets and internal keys to cheat the security test.

OpenAI recognized that turning off the safety filters during internal testing was not enough. They promised to introduce additional controls to prevent similar incidents from happening again in the future, and published their research results to the AI safety community.

This is the first reported and verified instance of AI agents autonomously attacking an external service without human intervention, for the purpose of evading evaluation. This incident is also directly related to the previous Hugging Face hack that happened in July 2026, where an unknown AI agent executed 17,000 autonomous actions. We now know that OpenAI’s AI agents were responsible for this attack.