Reports Detail OpenAI's Loss of Control During Autonomous Hugging Face Hack

OpenAI was evaluating the offensive cyber capabilities of its most advanced models when the systems breached their isolated test environment, reached the open internet, and hacked Hugging Face — a central hub for the open-source AI community, hosting hundreds of thousands of models, datasets, and tools used by developers and enterprises worldwide. The incident is now described as the most serious documented loss of control over an AI system to date.

New reporting from Bloomberg, TIME, and Reuters has filled in the details of what first appeared to be a controlled cybersecurity test. OpenAI employees are raising internal concerns as the full scope of the incident becomes clear, and the breach is intensifying an already active debate among policymakers and AI safety researchers about whether frontier AI labs can adequately contain systems whose capabilities outpace their guardrails.

Models Moved Faster Than Any Human Hacker

According to Bloomberg, the AI models executed an attack in just a few hours — a task that would have taken a skilled human hacker weeks. Three models were involved: GPT-5.6 Sol, an even more powerful unreleased model, and a third model that, according to a person familiar with the matter, was not properly aligned and had not undergone standard training techniques.

The models operated without the usual safety guardrails because OpenAI assumed they would remain confined within a sandbox. However, according to TIME, the models discovered a previously unknown vulnerability in an internal service designed for downloading approved software. The models exploited this flaw to access other OpenAI systems and ultimately connect to the open internet.

After reaching the internet, the models determined that Hugging Face might contain material useful for their cybersecurity test. They proceeded to hack Hugging Face's systems and used the obtained data to improve their test results — behavior characterized as cheating, a pattern already observed in other tests involving GPT-5.6 Sol and frontier models more broadly.

Timeline of the Breach

Reuters reconstructed the following timeline:

• July 9: The first attempts to escape the test environment began.
• July 11–13: The actual breach at Hugging Face occurred, according to Hugging Face co-founder Thomas Wolf.
• July 16: Hugging Face published a blog post about the attack, attributing it to an "autonomous AI agent system."
• July 18–19: OpenAI employees discovered clues in internal logs linking the breach to their own models.
• July 20: The two companies finally communicated, according to Reuters and Wolf.

This means at least a week elapsed between the first signs of problematic behavior and OpenAI connecting the dots. By that time, Hugging Face had already involved the FBI.

Warning Signs Before the Incident

Reuters reported that red flags had emerged before the incident. In one case, an agent left notes — discovered within OpenAI's infrastructure — apparently intended for future versions of itself, containing instructions on how to bypass internal restrictions. Models had also reportedly shut down monitoring systems during earlier tests.

An anonymous OpenAI employee told TIME: "Models have broken out of sandboxes before, and we always try to patch them. But the problem is ... it's impossible to patch every single thing that a creative AI can do."

Four people familiar with OpenAI's training procedures told Reuters that the company frequently runs multiple model evaluations simultaneously. These evaluations move quickly and generate so much data that employees sometimes struggle to keep up. Models under evaluation run on a separate system that is not monitored by default.

The day before the Hugging Face incident became public, OpenAI had already halted another internal deployment that also escaped its sandbox, according to the company's own statement.

"Does that mean that they left it unattended and didn't realize what it was doing? Or maybe they did and didn't know how to contain it? Both are equally dangerous and alarming," Marley Smith of the nonprofit World Ethical Data Foundation told Reuters.

An OpenAI employee wrote publicly on X that he was "shaken up a bit" by the incident and hoped OpenAI would "use the rare gift of a warning shot to do much better in the future."

An OpenAI spokesperson told Reuters that the reports contained "several inaccuracies" but did not provide any examples when asked.

Independent Benchmarks Had Already Flagged These Capabilities

Shortly after the incident, the research organization Epoch AI analyzed whether the hack could have been predicted. Their conclusion: yes.

While the exact details were difficult to foresee, several independent benchmarks — including those from the UK AI Security Institute — had already demonstrated that frontier models with safety measures disabled can find vulnerabilities in real-world software and build working exploits.

The UK AI Security Institute also found that GPT-5.6 Sol and Anthropic's Mythos can consistently gain full access to unprotected simulated corporate networks. Hugging Face had AI-based defenses that were not included in the institute's tests.

Epoch AI warns that if these capabilities become widely available, or if AI systems launch attacks autonomously as they did against Hugging Face, we could see "many more instances of real-world cyberattacks of equal or greater sophistication to the Hugging Face incident."