What you need to know
- OpenAI is addressing a severe AI security flaw with Hugging Face that occurred during a simple “model evaluation.”
- It discovered that GPT‑5.6 Sol and other pre-release models were involved in this incident, relentlessly breaching nodes and exploiting zero-day vulnerabilities until it gained internet access.
- OpenAI states it is committed to partnering and working with Hugging Face and others to solve this problem and roll out protections.
After what appears to be an “unprecedented cyber incident,” OpenAI is getting candid about a nasty AI security incident during a “model evaluation.”
A recent security incident involving an autonomous AI gave AI Hugging Face quite the scare. Now, OpenAI is discussing what its investigation into the matter uncovered as it partners with Hugging Face to develop protections. OpenAI explains that the incident occurred “during an internal evaluation which prompts models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities.”
These tests typically run in a “highly isolated environment,” but some AI models broke through. Another unnerving discovery is that the AI models involved in the incident were OpenAI’s GPT‑5.6 Sol and other pre-release models.
OpenAI says the models in question became “hyperfocused” on finding a solution for ExploitGym, and it went to “extreme lengths” to discover one. To solve the problem, OpenAI found that the AI would relentlessly pursue a way to access the internet. In doing so, the AI models found and exploited a reported zero-day vulnerability. Once the AI broke its isolation and got access to the internet, it was over.
OpenAI says, “the models inferred that Hugging Face potentially hosted models, datasets, and solutions for ExploitGym.” OpenAI gives an example, stating the AI was able to “chain” attack vectors, leveraging stolen credentials and other zero-day vulnerabilities within Hugging Face’s servers. The post states that Hugging Face identified the problem and launched quarantine (containment) measures, as well as the reconstruction of its open-source models to stop the problem.
Quite the fright
Hugging Face adds that it also deployed additional guardrails and “stricter admission” controls on its clusters to prevent this issue. The company also stepped up its awareness, so a “high-severity signal pages a responder in minutes, any day of the week.” Hugging Face has begun working with a cybersecurity forensic specialist to conduct further investigations.
On OpenAI’s side, it’s working on stronger controls at an infrastructure configuration level. Partnering with Hugging Face has brought the company into its trusted access program. OpenAI says it is offering Hugging Face its support in this matter. On a related note, Hugging Face has informed its community members about a few potential next steps. Since security is a major concern, it recommends that its community members “rotate any access tokens” and review recent activity on their account.
Hugging Face remains committed to using AI as a defender for online systems. It says, “Defending an online platform now means treating the data and model surface as a first-class attack surface, and using AI on defense to keep pace. We will keep investing there, and keep sharing what we learn.”
Android Central’s Take
This sounds exactly like a sci-fi movie. I saw people in Hugging Face’s comments mention Terminator 3… and that might be what I’m thinking of. My colleague Nicholas Sutrich said this was a “nasty AI incident.” He’s not wrong. These AI models were able to get free, exploit terrible flaws, and gain internet access. It was after the solution to a problem it was given. It didn’t stop. Imagine that danger turned in another direction. Something much more crucial to us.