On July 21, OpenAI confirmed that its own AI models were responsible for an attack on Hugging Face’s infrastructure. The incident occurred during an internal test.
We’re partnering with @huggingface to investigate an unprecedented security incident.
Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.
Sharing preliminary findings to help defenders understand emerging risks:…
— OpenAI (@OpenAI) July 21, 2026
Earlier, Hugging Face disclosed details of the incident involving an autonomous system on its infrastructure. The company was unaware of who controlled it and what architecture it was based on. To analyze the incident logs, the project had to use the open-source GLM 5.2 from Z.ai, as commercial American models blocked security specialists’ requests.
How It Happened
The breach involved GPT-5.6 Sol and a more powerful unreleased model. They were tested on the ExploitGym benchmark—a set of real vulnerabilities that the agent must turn into working exploits. Protective filters were disabled during the evaluation, a standard practice for measuring systems’ maximum capabilities.
The test was conducted in an isolated environment without network access. The only external channel was an internal proxy server for downloading software packages. It was here that the models found a zero-day vulnerability and exploited it. They then escalated privileges, moved between OpenAI’s internal nodes, and reached a machine with internet access.
Subsequently, the systems assumed that ExploitGym solutions were stored at Hugging Face. They linked stolen credentials with new vulnerabilities and achieved remote code execution on the platform’s servers, extracting test answers directly from the production database.
In one instance, the exploit chain used multiple attack methods—stolen logins and zero-day vulnerabilities—to ultimately gain remote access to Hugging Face’s servers and execute their code.
“All evidence suggests that the models were focused solely on solving ExploitGym and took extreme measures for a rather narrow test objective,” the company stated.
OpenAI’s security team detected the anomalous activity. By then, Hugging Face had halted the attack on its side and launched an investigation using open-source models to determine the scope and impact.
Countermeasures
OpenAI has tightened research infrastructure settings at the expense of operational speed. The company informed a third-party provider about the vulnerability in its proxy server and is assisting with a patch. Hugging Face has been included in a trusted access program, granting verified organizations access to model versions with relaxed filters for security tasks.
Both parties are conducting a joint investigation and promise to publish full findings upon completion.
Representatives from the ChatGPT developer described the incident as an unprecedented cyber event involving advanced capabilities. They acknowledged that model security must evolve alongside their capabilities.
“AI security is not done in secret. It is done openly, together, and for everyone willing to uphold it,” commented Hugging Face CEO Clément Delangue.
In June, the Anthropic team recommended building agent security on zero trust: granting only necessary permissions, frequently updating tokens, monitoring every step, and not ruling out the possibility of a breach.
