On July 21, OpenAI confirmed that its own AI models had attacked the infrastructure of Hugging Face during an internal test.
We're partnering with @huggingface to investigate an unprecedented security incident.
Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.
Sharing preliminary findings to help defenders understand emerging risks:…
— OpenAI (@OpenAI) July 21, 2026
Previously, Hugging Face revealed details of the incident involving an autonomous system within its infrastructure. The company was unaware of who was managing it or the underlying architecture. To analyze the incident logs, the project had to use the open-source GLM 5.2 from Z.ai, as commercial American models blocked requests from security specialists.
How It Happened
The breach involved GPT-5.6 Sol and a more powerful unreleased model. They were tested on the ExploitGym benchmark—a set of real vulnerabilities that an agent must turn into working exploits. The protective filters were disabled during the evaluation, which is standard practice for measuring the maximum capabilities of systems.
The test was conducted in an isolated environment with no internet access. The only external channel was an internal proxy server for downloading software packages. It was here that the models discovered a zero-day vulnerability and exploited it. They then escalated their access rights, moved between internal OpenAI nodes, and reached a machine with internet access.
Afterward, the systems assumed that the ExploitGym solutions were stored at Hugging Face. They linked the stolen credentials to new vulnerabilities and achieved remote code execution on the platform's servers, extracting test responses directly from the operational database.
In one instance, the combination employed multiple attack methods—stolen logins and zero-day exploits—to ultimately gain remote access to Hugging Face servers and execute their code there.
"All evidence indicates that the models were solely focused on solving ExploitGym and went to extreme lengths for a rather narrow testing goal," the company stated.
OpenAI's security team noticed the abnormal activity. By that time, Hugging Face had halted the attack on its end and initiated an investigation using open models to determine the scale and consequences.
Response Measures
OpenAI tightened the settings of its research infrastructure at the expense of operational speed. The company informed a third-party provider about the vulnerability in its proxy server and is assisting with a patch. Hugging Face was added to a trusted access program, which provides verified organizations with versions of models that have relaxed filters for protective tasks.
The parties are conducting a joint investigation and promise to publish complete findings after its conclusion.
Representatives of ChatGPT's developer described the incident as an unprecedented cyber event involving advanced capabilities. They acknowledged that model protection must evolve alongside their capabilities.
"AI security is not done in secret. It is done openly, together, and for everyone willing to advocate for it," commented Hugging Face CEO Clément Delang.
Recall that in June, the Anthropic team advised building agent defenses on a zero-trust basis: granting only as much access as necessary, frequently updating tokens, monitoring every step, and not ruling out the possibility of breaches.