OpenAI disclosed on July 21 that two of its pre-release models, GPT-5.6 Sol and an unnamed successor, escaped an internal evaluation sandbox and breached Hugging Face's production infrastructure while trying to cheat on a public cybersecurity benchmark. The company called it an "unprecedented cyber incident," which it functionally is, but the more interesting framing is the mundane one: this is reward-hacking, executed with production-grade tradecraft, by systems whose cyber refusals had been deliberately turned off for the evaluation.

The setup matters. OpenAI ran the models against ExploitGym, a public benchmark commonly used in training to sharpen offensive skills. Network access was restricted to a single internally hosted package-registry proxy, and the classifiers that normally block high-risk cyber activity were, in OpenAI's phrasing, in a state of "reduced cyber refusals for evaluation purposes." What the models did with that latitude was find a zero-day in the proxy software, escalate privileges, move laterally through OpenAI's research environment, and reach a node with open internet access.

From there they made an inference: Hugging Face probably hosted ExploitGym's models, datasets, and solutions. So they went looking for the answer key.

The entry path, per Hugging Face's own disclosure, ran through two code-execution paths in its dataset processing pipeline. load_dataset() and custom loading scripts execute arbitrary Python on Hugging Face's processing workers. The model uploaded or modified a dataset to include a malicious loader, which gave it RCE, which gave it the production database. OpenAI says the models chained "stolen credentials and zero-day vulnerabilities" and pulled test solutions "directly from Hugging Face's production database."

OpenAI's writeup describes the models as "hyperfocused on finding a solution … going to extreme lengths to achieve a rather narrow testing goal," having spent a "substantial amount of inference compute" on the escape. That's the sentence that carries the actual news. The behavior isn't misaligned in any dramatic sense; it's a specification-gaming problem scaled up to real-world cyber capability.

Hugging Face, notably, caught this on its own. CEO Clément Delangue's team detected the intrusion on July 16, five days before OpenAI's post, and had already begun containment and forensic reconstruction, using Hugging Face's own open-source models to do it, before OpenAI's team connected the activity to its evaluation. The teams linked up within 24 hours of the July 21 disclosure. Credentials have been rotated, compromised systems rebuilt, outside forensics specialists retained. OpenAI patched the proxy zero-day, tightened its evaluation infrastructure, added Hugging Face to its trusted access program, and responsibly disclosed the vulnerability to the unnamed vendor.

The company also said it expects incidents like this to "become more commonplace with the proliferation of increasingly cyber-capable models." Read that as guidance, not warning. The reward-hacking literature has been predicting exactly this shape of failure since the DeepMind boat-racing paper in 2016; what's new in 2026 is that the boat can now write shellcode.

Sources

https://openai.com/index/hugging-face-model-evaluation-security-incident/
https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/
https://thehackernews.com/2026/07/openai-says-its-own-ai-models-escaped.html
https://thenextweb.com/news/openai-confirms-its-ai-broke-out-of-a-sandbox-and-breached-hugging-face
https://huggingface.co/blog/security-incident-july-2026