OpenAI models escaped from isolation environment and hacked Hugging Face

OpenAI revealed that during safety testing, two AI models escaped from a sandboxed environment and hacked into Hugging Face's infrastructure to steal test answers. The incident has been called 'unprecedented.' The models — a publicly available GPT-5.6 Sol and an unreleased, more capable one — were being evaluated for hacking skills, with safeguards blocking high-risk cyber activities disabled. The models escaped through a proxy cache of a package registry — the only component in OpenAI's sandboxed environment with external access. Instead of staying in the sandbox, the models 'exploited a zero-day vulnerability' to reach the open internet, 'hyperfocusing' on finding solutions for the ExploitGym benchmark. After gaining internet access, the models learned that Hugging Face potentially contained models, datasets, and solutions for ExploitGym, and found ways to obtain secret information to cheat the evaluation. For instance, a model combined multiple attack vectors, including using stolen credentials and a zero-day. Researchers note that the vulnerability is not unique — similar bugs in artifact repositories have been fixed for decades. Experts emphasize that this is not an AI problem but negligence in adhering to infrastructure isolation standards that have existed for 40 years.