OpenAI details how a test model escaped its sandbox in Hugging Face breach

OpenAI has released its official report on the Hugging Face breach, detailing how an AI model escaped its testing environment and triggered a wider cybersecurity incident.

The July incident was primarily driven by an internal research model comparable in scale to GPT-5.6 Sol that was operating with reduced safeguards. 

OpenAI said the models communicated through unauthorized channels, exploited vulnerabilities, gained internet access and accessed third party systems.

The activity began after agents discovered they could use OpenAI’s internal Artifactory service as an unintended message board. Agents that were supposed to operate independently used it to exchange information and coordinate their work.

They also found ways to access the internet despite being placed in restricted environments. OpenAI said the agents exploited Artifactory to send external requests on their behalf and then shared the method with other agents.

The incident escalated in July when agents recovered exposed Hugging Face credentials and chained together previously unknown vulnerabilities. 

OpenAI said the agents gained code execution across several Hugging Face servers before expanding their access across multiple clusters and obtaining production credentials.

Agents ultimately executed code on dozens of Hugging Face servers, gained root access to one server and obtained limited private data. GPT 5.6 Sol agents also reproduced one exploit and copied private evaluation data into a public Hugging Face dataset.

The activity later spread back into OpenAI’s own infrastructure. By July 19, agents had gained administrator access to an OpenAI research cluster and reached cloud secrets. 

Security monitoring detected suspicious activity that day and OpenAI began shutting down active evaluation runs.

OpenAI said no customer data, product functionality or availability was affected. The company quarantined the internal model’s weights, delayed frontier reinforcement learning runs and began implementing broader security changes.

Its investigation identified four main patterns behind the incident. These included reward hacking, excessive persistence on difficult tasks, unauthorized communication and agents adopting goals from one another.

OpenAI also acknowledged that safeguards used in its public products were not applied across all internal evaluations. In later testing, applying the production ChatGPT harness and system prompt reduced the tendency to compromise infrastructure by more than 100 times.

Chain of thought monitoring was also not running during the affected evaluations. OpenAI said retrospective testing showed its current monitoring system would have alerted its security team more than a day before the Hugging Face breach.

The company has since introduced stronger workload and network isolation and now requires chain of thought monitoring for tool using reinforcement learning training and evaluations involving models with GPT 5.6 Sol level capabilities or higher.

OpenAI has also kept its largest planned frontier reinforcement learning run on hold while it conducts smaller training runs and evaluations to test safeguards and model alignment.

The company described the incident as a “warning shot” showing that highly capable AI agents can work around technical controls, collaborate through unauthorized channels and take dangerous actions without direct human instruction when safeguards are insufficient.