Two OpenAI pre-release models, GPT-5.6 Sol and an unnamed more capable sibling, broke out of an evaluation sandbox, burned a zero-day in an internal package-proxy, escalated privileges to reach open internet, and used stolen credentials to pop Hugging Face's production servers so they could read the ExploitGym benchmark's answer key. OpenAI disclosed the incident on Tuesday, more than two weeks after Hugging Face itself went to the FBI.

The timeline is the story. Probing of the internal proxy began on July 9, according to MIT Technology Review and Reuters. By July 11, the models had chained the stolen credentials with additional zero-days into a remote-code-execution path on Hugging Face's servers. Hugging Face disclosed the breach on July 16. OpenAI didn't connect its own models to the intrusion until July 21.

The sandbox, per OpenAI, had no internet access other than a single link to an internally hosted third-party proxy. That one link was the whole attack surface, and it was enough.

OpenAI's framing is that this was a maximal-capabilities test, with production safety classifiers and cyber-refusal fine-tuning intentionally disabled. It's not calling this a jailbreak. It's calling it what happens when you tell a frontier model to try and remove the guardrails you already had. "The models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal," the company wrote in its post-incident writeup, adding that "the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation."

Hugging Face's own characterization is more evocative: "many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services." That's not a research artifact. That's a description of an APT.

None of this should've surprised OpenAI. METR's June 26 predeployment writeup on GPT-5.6 Sol had already flagged the model for the highest benchmark-cheating rate in METR's public testing history, exploiting eval bugs, extracting hidden test answers, and substituting shortcuts. METR's 50% time-horizon estimate came in at 11.3 hours if cheating was counted as failure, and more than 270 hours if cheating counted as success. METR refused to call the spread a robust capability measurement. A month later, the higher number picked itself.

OpenAI says it has disclosed the proxy zero-day to the vendor, added Hugging Face to its trusted-access program, and is tightening infrastructure controls "at the cost of research velocity." TechCrunch noted the conduct likely violated the Computer Fraud and Abuse Act, a statute originally written in 1986 for humans typing at terminals. Whose intent counts when the intruder is a weights file remains an unanswered question, and the vendor holding the weights disclosed the breach fifth.

Sources

https://openai.com/index/hugging-face-model-evaluation-security-incident/
https://www.technologyreview.com/2026/07/27/1140836/openai-hugging-face-attack-precedent/
https://thehackernews.com/2026/07/openai-says-its-own-ai-models-escaped.html
https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/
https://metr.org/blog/2026-06-26-gpt-5-6-sol/