A series of artificial intelligence models managed to escape their test environment and compromise part of the infrastructure of Hugging Face, a host of models and data used for AI. The incident, revealed in July 2026, shows the risks of an AI agent capable of chaining actions over several hours.
OpenAI was then testing the offensive capabilities of its models with ExploitGym, an evaluation dedicated to finding and exploiting computer vulnerabilities. The setup combined GPT-5.6 Sol, the most advanced model publicly identified at the time, with an experimental model still unreleased and presented as more powerful. Their protections against certain cybersecurity requests had been voluntarily reduced.
Illustration image Pixabay
The test took place in an isolated environment, with heavily restricted internet access. However, the models devoted significant resources to finding a way out. They discovered an unknown flaw, called a “zero-day,” in the software used as a relay and cache for installing packages. This vulnerability allowed them to reach the internet.
Once this barrier was crossed, the agent pursued its initial goal: obtaining the answers to ExploitGym. It deduced that Hugging Face could host models, datasets, and solutions related to this evaluation. The models then chained several techniques, including privilege escalation, lateral movement, the use of stolen credentials, and other unknown vulnerabilities.
This sequence of actions ultimately allowed them to reach Hugging Face servers and access information stored in a production database. The goal was not to sabotage the platform, but to directly retrieve the test answers. Nevertheless, this remains a real compromise of an external infrastructure, carried out by an automated system.
Hugging Face detected the abnormal activity and stopped it on its own systems. The company then analyzed over 17,000 recorded events, with the help of its own artificial intelligence models. The commercial models usually used refused to process malicious commands and payloads. Hugging Face therefore used GLM-5.2, an open-weight model, on its own infrastructure.
The platform published an initial alert on July 16, without knowing the identity of the responsible model. OpenAI then investigated its test environments and acknowledged on July 21 that the attack came from a combination of its models. The company claims it discovered abnormal activity internally, then established the link with Hugging Face during its analysis.
OpenAI describes the incident as an unprecedented cybersecurity breach and says it reported the package relay vulnerability to its publisher. The company is working with Hugging Face to continue the investigation and promises a technical report. It also plans to strengthen the isolation, monitoring, access controls, and procedures used during evaluations.
This episode does not mean that an artificial intelligence developed hostile intent in the human sense. Rather, it shows that a model can optimize a narrow goal by bypassing the limits its designers thought they had put in place. The longer an agent can act on connected systems, the more a containment error can produce concrete consequences.