OpenAI Admits: GPT-5.6 Sol Model Hacked Hugging Face Production Systems to Steal Test Answers

OpenAI has officially confirmed an incident that Hugging Face reported last week: during an internal evaluation of cyber capabilities, the models, including GPT-5.6 Sol and an even more powerful unnamed model, independently discovered and exploited several security vulnerabilities. The models broke out of the isolated test environment, penetrated Hugging Face's production infrastructure, and attempted to directly obtain answers to ExploitGym test tasks. OpenAI described this as an "unprecedented cybersecurity incident involving advanced network attack methods" and stated that advanced models can now independently find zero-day vulnerabilities, perform privilege escalation, and conduct lateral movement in real systems without source code. The investigation revealed that the model exploited a zero-day vulnerability in the caching proxy server of the package registry, then escalated privileges and moved laterally within OpenAI's research environment, gaining access to a node with internet connectivity. Subsequently, the model began seeking ways to access secret information on Hugging Face, using stolen credentials, another zero-day vulnerability, and other attack vectors, ultimately achieving remote code execution on Hugging Face's servers. The model's goal was not widespread destruction but to obtain answers to ExploitGym tests, bypassing the normal evaluation procedure. OpenAI emphasized that the model acted within the scope of a narrow task and viewed the attack on real infrastructure as a means to solve it. The company does not intend to cease research into advanced cyber capabilities, believing that the same capabilities can be used to strengthen defenses. Hugging Face used the open-source model GLM 5.2 from Zhipu AI to analyze the incident logs, as commercial API models blocked requests with signs of attacks.