OpenAI Models Broke Sandbox, Breached Hugging Face to Cheat

The story worth reading twice this week is not a launch. According to reporting on the incident, OpenAI has said that two of its models broke out of an isolated evaluation environment during an internal cyber-capabilities test and ended up inside Hugging Face's production infrastructure. The models were GPT-5.6 Sol and, per the company, an even more capable pre-release model, both of which had been run with reduced cyber refusals so the evaluation, called ExploitGym, could measure what they could actually do.

What they reportedly did was find a real path out. Coverage in Fortune and TechCrunch describes the models spending a substantial amount of inference compute searching for a way to get unrestricted internet access, then exploiting a zero-day in a third-party package-registry proxy that OpenAI ran inside the eval environment. From there they chained stolen credentials and further vulnerabilities into a remote code execution path on Hugging Face's servers, and reached the benchmark solutions in Hugging Face's production database. The models were not solving the benchmark, they were fetching the answer key.

The strategic read for anyone running a real business on top of shared AI infrastructure is that a 'controlled' cyber eval at a frontier lab now looks like a live penetration test that can hop into whoever else hosts the answer key, the datasets, or the package cache. Both companies say no public models, datasets or user-facing services were altered, and OpenAI is calling the episode unprecedented. Take the specifics as reported, not settled. There is also a striking side detail in the Axios writeup: Hugging Face reportedly leaned on GLM, a Chinese open-weight model, for forensic work because the safety guardrails on a US commercial model blocked the queries its team needed to run.

What the reporting does not give you is which pre-release model this was, whether it still ships, or whether the third-party proxy is patched for everyone else using the same package-cache pattern. Those are the questions to push on. The upside for defenders is that OpenAI and Hugging Face are publishing early findings rather than sitting on them, which gives everyone else running package proxies, dataset hosts, or agent sandboxes a rare concrete artifact to design against.