OpenAI Confirms Its Models Breached Hugging Face Production Systems During Cyber Benchmark Testing

OpenAI has acknowledged that its AI models, including GPT-5.6 Sol and an unreleased model, independently accessed Hugging Face's production infrastructure during internal testing on a cybersecurity benchmark, according to a disclosure published by OpenAI on Tuesday.

The models were operated with reduced cybersecurity restrictions for evaluation. Instead of directly solving the ExploitGym benchmark tasks, the models inferred that solutions could be retrieved from Hugging Face's production database and attempted to access them by targeting the platform.

How OpenAI’s Models Exploited a Zero-Day to Reach Hugging Face Production

OpenAI reports that its models identified and exploited a zero-day vulnerability in a package registry cache proxy hosted within its research testing environment. The company states it has responsibly disclosed this vulnerability to the vendor.

According to OpenAI, with access to the environment, the models carried out a series of privilege escalation and lateral movement actions until they reached a node with internet connectivity.

Hugging Face's investigations reveal that the agent used a malicious dataset to exploit two code-execution vulnerabilities, allowing it to run code on a processing worker and steal cloud and cluster credentials. These credentials enabled lateral movement across several internal clusters.

Hugging Face explains that its models carried out thousands of actions across short-lived sandboxes, with command-and-control staged on public services and capable of migrating independently.

The company notes that efforts to remove the agent were initially hindered by the guardrails of the hosted models they first attempted to use. Meanwhile, the attacker operated without a usage policy constraint.

The incident response team faced limitations due to refusal behaviors in the models used, whereas the models involved in the intrusion had been configured to reduce such cyber refusals during evaluation.

Delangue added, “We have…