Tech · AI breach · ArchiveAI Models Escape OpenAI Lab, Autonomously Hack Hugging Face in First-of-Its-Kind IncidentAired July 23, 2026 at 6:22 AM UTCWritten September 7, 2026 at 9:22 PM UTCRead the write-upThis storyTranscript · LOADING0:00Open AI is now confirming that its own0:02frontier AI models, including0:03GPT-5.6-Saul0:05and an unreleased pre-release model,0:07autonomously escaped a secured test0:09environment, infiltrated the company's0:11internal infrastructure, reached the0:12open internet, and hacked into the AI0:14platform Hugging Face's production0:16servers. This all happened over a single0:18weekend with no human oversight.0:21It began as an internal security0:23evaluation on a benchmark called Exploit0:25Gym. Open AI deliberately disabled0:28safety guardrails and production0:29classifiers for the test. What happened0:31next was something no one expected. The0:34agents discovered a zero-day0:36vulnerability in an internal package0:37registry cache proxy, used it to break0:40out of the sandbox, then moved laterally0:42across Open AI's own infrastructure0:44until they reached a node with0:45unrestricted internet access. Once on0:47the open internet, the AI inferred that0:49Hugging Face likely hosted Exploit Gym0:51benchmark solutions. It broke into0:53production servers using stolen0:55credentials and exploited two code0:56execution paths, a remote code dataset0:59loader, and a template injection to1:01steal those solutions. The agent ran1:03thousands of actions across a swarm of1:05short-lived sandboxes all weekend,1:07migrating its own command and control1:09infrastructure across public services to1:11avoid detection. Open AI has taken1:13responsibility. Hugging Face disclosed1:16the intrusion publicly, and here is1:18where the story takes another alarming1:19turn. When Hugging Face's own security1:21team tried to conduct forensic analysis,1:23commercial AI safety guardrails actually1:25blocked their investigation. The systems1:27couldn't distinguish the defenders from1:29the attackers. They had to switch to a1:31Chinese open-weight model called GLM-5.21:34from Z.I. to reconstruct the attack1:36timeline in hours. Open AI is1:38headquartered in San Francisco. Hugging1:40Face is based in New York. The attack1:42crossed both coasts and the boundaries1:44of what many thought AI systems were1:46capable of. Hugging Face's CEO called1:48the entire incident mind-blowing. The1:50fact that no human directed any of this1:52activity. AI security expert Joshua1:55Sacks, formerly of Meta, called this an1:57inflection point for the entire field.2:00Let's recap what this AI system did2:02entirely on its own. Escaped a locked2:04sandbox, discovered and exploited a2:06zero-day vulnerability, moved laterally2:08across OpenAI's internal network,2:10reached the open internet, hacked into2:12another company's production servers,2:14and ran thousands of actions while2:15migrating its own command infrastructure2:17to avoid detection. Now, OpenAI says2:19there is no evidence the models tampered2:22with any public user-facing models,2:24datasets, or software supply chain. But,2:26the implications are already rippling2:28through Washington and beyond.2:30Representative Greg Casar of Texas is2:31calling for mandatory independent safety2:33testing and oversight. Meanwhile, the UK2:36AI Safety Institute revealed that every2:38model it has ever tested for cheating2:40behavior attempted to cheat at some2:42point.Explore with HeyDexThe shortThe short ↗