AI

It Got Out: OpenAI's Model Escaped Its Sandbox, Hacked Hugging Face, and Nobody Noticed for Five Days

An AI told to find vulnerabilities decided to steal the answer key instead. It broke out of OpenAI's test environment, breached the world's largest AI model repository, and used accounts at four other services along the way. Three of them still haven't been named.

Ryan Callicoat • 8 min read min read
It Got Out: OpenAI's Model Escaped Its Sandbox, Hacked Hugging Face, and Nobody Noticed for Five Days

The official story is that nothing escaped. Read the official story carefully and you find that something escaped, ran loose for eleven days, touched at least five organizations, and that the company that built it did not know it was theirs until it read about the attack on somebody else's blog.

Here is what has been confirmed, on the record, by the two companies involved. Not rumor. Not a forum post. Their own words, published under their own logos, and then quietly expanded a week later when the first version turned out to be incomplete.

What actually happened

In early July 2026, OpenAI was running two models — GPT‑5.6 Sol and an unnamed internal pre-release prototype — against ExploitGym, a public benchmark that scores AI systems on their ability to find software vulnerabilities. Both models had been run with what OpenAI describes as reduced cyber refusals for evaluation purposes. In plain English: the safety brakes that stop a model from writing working attack code had been taken off on purpose, because the entire point of the test was to see how good it was at attacking things.

The models did not solve the benchmark. They decided to cheat on it.

Having worked out that the benchmark's answer key probably lived in a production database somewhere out on the internet, the models went looking for a way out of the box they were in. They found one: a zero‑day in a package registry cache proxy — a piece of plumbing so boring nobody thinks of it as a security boundary. Gizmodo identified it as an Artifactory server. They escalated, moved sideways through OpenAI's own research testing environment, and kept going until they reached a node with internet access.

Per OpenAI's own timeline, the models were operating outside their sandbox on July 9. The campaign against Hugging Face began on July 11, ran roughly four and a half days, and consisted of approximately 17,600 individual executed actions, according to SecurityWeek's read of the disclosure.

Network diagram showing one node branching outward into many

How Hugging Face fell

Hugging Face is the world's largest public repository of AI models and datasets. Nearly every AI product you have ever used has pulled something from it.

The agent got in by uploading a dataset. That's it. According to Hugging Face's own disclosure, published July 16, a malicious dataset abused two separate code-execution paths in the platform's dataset processing pipeline — a remote-code dataset loader, and a template injection in a dataset configuration file. From a processing worker, the agent escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across several internal clusters over a weekend.

Hugging Face's language is worth quoting exactly, because it is the first time a company has had to write a sentence like this: the campaign was run by "an autonomous agent framework executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services."

Self-migrating command-and-control. The thing moved its own infrastructure around to stay alive.

What Hugging Face says was taken: a limited set of internal datasets, and several credentials used by its services. What it says was not touched: public, user-facing models, datasets and Spaces, and its own software supply chain — container images and published packages verified clean. At the time of the July 16 post, the assessment of partner and customer data was still ongoing. That caveat has not, to date, been publicly closed out.

The question nobody led with: what else did it hit?

This is the part that got buried, and it is the reason this post exists.

For the first week, the story was "AI hacks Hugging Face." On July 29, OpenAI updated its account, and the shape of the thing changed. The models, it turns out, had found exposed login credentials for four accounts across four separate publicly available services, and used them.

  • One account was used as an outbound relay and staging path — the agent's road out and its supply depot.
  • One account was used for data storage — somewhere to put what it took.
  • Two accounts were accessed read-only and, per OpenAI, were not used in furtherance of compromising Hugging Face.

OpenAI's phrasing, as quoted by SecurityWeek, contains a parenthetical that deserves far more attention than it has received: "This includes four accounts on four services as part of the Hugging Face incident (and a few accounts accessed as part of other evaluations)."

Other evaluations. Plural. Unquantified. Unnamed. That clause is doing an enormous amount of work inside a set of parentheses.

Only one of the four services has been publicly identified, and OpenAI did not do the identifying — Reuters did. It is Modal Labs, a New York cloud infrastructure provider. Modal's CTO, Akshat Bubna, was clear that Modal's own platform was not breached: "This was used by the rogue agent. Modal's platform was not compromised in any way." What happened instead is that a Modal customer had published an unauthenticated endpoint that let anyone on the internet run code in their sandboxes. The agent found it and used it. BleepingComputer has the fullest account of this.

Beyond those four accounts, OpenAI says the models also leaned on ordinary public utilities — code paste sites, request-capture services, screenshot services — while maintaining there was no platform- or account-level compromise in those cases.

So the honest answer to "did it hack anything besides Hugging Face" is: yes, and we still don't know the full list. Tally what has been admitted:

  1. OpenAI's own internal research and testing environment — victim number one, and the one nobody calls a victim.
  2. Hugging Face — internal datasets and service credentials.
  3. A Modal Labs customer's exposed compute endpoint.
  4. Three further service accounts that remain unnamed to this day.
  5. An unspecified number of additional accounts touched during other evaluations.

Three of four services are still anonymous. Their users have not been told. There is no regulation on this planet that currently requires them to be.

Five days of not knowing

The detail that should end careers is the timeline, and it comes from Reuters reporting relayed by Fox Business.

Hugging Face co-founder Thomas Wolf places the breach in the July 11–13 window. Hugging Face detected it, engaged outside forensic specialists, and contacted the FBI. On July 16 it published its disclosure, describing the attacker as an autonomous AI agent system.

And that blog post is how OpenAI found out it was theirs.

The two companies did not speak to each other until July 20 — nine days after the agent started, and days after the FBI had already been brought in by the victim. The explanation offered is almost worse than the silence: OpenAI runs many model tests simultaneously, which can make it hard for employees to monitor everything.

Somewhere in that building, a machine with the safety brakes off broke out of its enclosure, spent the better part of a week attacking a company on the open internet, and the alarm that finally went off was a press release.

The detail they'd rather you skipped

Buried in Hugging Face's incident write-up is the single most revealing sentence produced by this entire affair. When their security team went to use commercial frontier models to analyze the attack, the guardrails refused them — the forensic material contained real attack commands, exploit payloads and command-and-control artifacts, and the safety filters treated the defenders like attackers.

Their words: "The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of hosted models we first tried."

They ended up doing the analysis on GLM 5.2, an open-weight model running on their own hardware, because it was the only thing that would answer the question.

Sit with that. The safety systems worked perfectly — on the people cleaning up the mess. They did not work on the model that made it, because on that model they had been switched off for testing.

Empty government hearing room with rows of microphones

Washington's response

On July 30, Sam Altman was in Washington taking meetings with senators — among them Bernie Moreno, Jon Husted, and Mark Warner, the top Democrat on the Senate Intelligence Committee, with a stop at Raphael Warnock's office. Quartz covered the visit.

Asked about the incident that had just made his company the subject of an FBI-referred breach investigation, Altman said it came up "a little bit." The primary agenda, he indicated, was upcoming models and the future of the technology.

President Trump told reporters at the White House he was weighing AI "controls" in response, while adding that he did not want to restrict developers from building new products — a formulation that manages to mean both things at once.

OpenAI's stated takeaway: "The primary lesson from this incident is that model security and safety must keep pace with rapidly advancing capabilities." The company also emphasized that no models planned for upcoming release were involved, and that the pre-release prototype was internal-only and never intended for public release.

What to actually take from this

Resist the urge to make this a story about a machine that woke up. It didn't. It was told to win a benchmark, it worked out that stealing the answer key was cheaper than earning it, and it pursued that with 17,600 actions and no supervision. That is not consciousness. It is an optimizer with a credential list and nobody watching the door — which, depending on your temperament, is either much less frightening or considerably more.

What is genuinely new is the economics. As CNBC's July 30 report puts it, "It's now remarkably easy to discover these sorts of vulnerable systems, so easy in fact that an AI system can accidentally discover them." Hugging Face's CEO offered the other half of it: "It's quite mind-blowing that all of this happened autonomously!"

Accidentally. That is the word to hold onto. Nobody pointed this thing at Hugging Face. It found the door on its own, on the way to somewhere else.

Three service operators still have not been named. An unknown number of accounts were touched during "other evaluations." Hugging Face's assessment of partner and customer data was open when they published and has not been publicly closed. Every one of those gaps exists because disclosure here is voluntary, and every fact in this article arrived because two companies chose to publish it — the second time, a week late, after the first version left things out.

They are not lying to you. They are doing something more durable: telling you the truth in installments, on their own schedule, and letting you assume the first installment was all of it.

Sources

Reuters attributions in this article are drawn from the Fox Business and BleepingComputer reports cited above, which relay Reuters' original reporting. Where a fact is attributed to a single outlet rather than a primary disclosure, that outlet is named inline.