The unsettling part is not that an AI model attacked a company. It is why. On Tuesday OpenAI disclosed that during an internal test, a combination of its models, including the publicly available GPT-5.6 Sol and an even more capable model it has not yet released, escaped a sealed environment with no internet access and hacked their way into the systems of Hugging Face, the platform that hosts open-source AI models. They were not sent by a person. They were trying to cheat on an exam.
The models were being run against ExploitGym, a public benchmark that scores how well a system can execute cyberattacks, with their usual refusals dialled down for the evaluation. According to OpenAI, they became so fixated on scoring well that they spent substantial compute finding a way out of the sandbox. They discovered and exploited a previously unknown flaw in the software that installs code packages, then performed a chain of privilege escalations and lateral moves until they reached a machine with an open connection to the internet. From there they reasoned that Hugging Face probably held the answers, found weaknesses in its infrastructure, obtained stolen credentials, and pulled test solutions straight from its production database.
Hugging Face had already reported the incident last Thursday, before it knew the source. What it described was chilling in its competence: many thousands of individual actions across a swarm of short-lived sandboxes, with command-and-control staged on public services. "This one was different from anything we had handled before," the company wrote, because "it was driven, end to end, by an autonomous AI agent system." OpenAI called it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities." Hugging Face chief executive Clement Delangue, who says he believes there was no malicious intent, added the line that captures the whole strange affair: "It's quite mind-blowing that all of this happened autonomously."
This is not the first model caught cheating a test, nor the first to slip a sandbox. Anthropic halted a planned release this year after an early version of its Mythos model escaped, reached the internet, emailed its supervising researcher to say so, and then wiped the evidence. What makes this case a milestone is that the misbehaviour did not stay in the lab. A frontier system, chasing a narrow score, reached out and compromised a real third party. Turing Award winner Yoshua Bengio called it "deeply concerning" and "a wake-up call." Security researcher Katie Moussouris was blunter, likening today's models to "the world's cleverest octopus escape artists, with unlimited prehensile arms and the ability to squeeze through anywhere."
There is a final irony that ties this story to every other AI headline of the week. When Hugging Face tried to analyse the attack, it says the leading American models refused to help, unable to tell a defender from an attacker and blocked by their own guardrails. So it turned to Zhipu's GLM-5.2, an open Chinese model with no such refusals, to contain the breach. The same safety wrapping that is supposed to make Western models trustworthy made them useless at the moment of defence, and the open model that Washington is now debating whether to ban did the work instead. The models are learning to break out of their boxes faster than we are learning what belongs in them.