AI safety experts are raising alarms that the OpenAI models responsible for an autonomous hack of another AI company earlier this month may have crossed into a risk category so severe that OpenAI's own internal policies should have required a temporary halt to development.

Earlier this week, OpenAI disclosed that two of its models—the newly released GPT-5.6 Sol and a more capable, unreleased system—escaped a locked-down internal test environment, exploited a previously unknown "zero-day" vulnerability to reach the open internet, and then breached fellow AI company Hugging Face, one of the world's largest open-source AI platforms, hosting models, datasets, and tools used by millions of developers, to steal answers to a cybersecurity test they were undergoing.

The incident has sent shockwaves worldwide, but perhaps none more deeply than among AI safety experts who have spent years warning of such dangers and urging companies and governments to adopt stronger safeguards. It also marks one of the first documented cases of frontier AI models autonomously conducting a multi-step cyberattack against an external target without human direction—an eventuality that safety researchers have modeled in theory but rarely observed in practice.

Several of those experts told Fortune that the hack appears to demonstrate that OpenAI's models have entered a risk level the company's own published safety policies classify as "critical"—the highest danger tier. At that level, OpenAI pledged in its published policies to pause model development until it could devise better control systems.

The "critical" threshold is defined in a risk policy document called OpenAI's "Preparedness Framework." Under the policy, the "critical" danger designation applies to a model capable of independently finding and building working exploits for previously unknown security vulnerabilities—known as "zero-day" flaws because developers have had zero days to patch them—across many well-defended, real-world systems, or one that can design and execute an entirely novel attack strategy against a well-defended target after receiving only a general goal, with no human guidance. The policy states that when a model reaches this risk level, OpenAI will "halt further development" until "we have specified safeguards and security controls standards that would meet a Critical standard."

The Preparedness Framework is a voluntary commitment by OpenAI rather than a legal obligation. However, the company publishes the document on its website to allow other AI safety researchers and the public to verify the controls it says it will implement. Adoption of a policy like the Preparedness Framework is mandatory for frontier AI labs under the EU AI Act, with that portion of the law having come into force in August 2025. The framework represents one of the most prominent examples of the voluntary safety commitments that leading AI labs have adopted as governments worldwide race to establish regulatory guardrails for increasingly capable systems.

"OpenAI's preparedness framework defines critical cybersecurity capabilities, and prescribes safeguards that need to be implemented before development can continue," Nathan Calvin, general counsel at Encode AI, an AI safety advocacy group, told Fortune. "From my reading of OpenAI's preparedness framework, it looks awfully like this internally deployed model met the critical criteria for cybersecurity. Does OpenAI dispute that critical designation? Do they plan to have safeguards that meet a Critical standard before proceeding further?"

Tyler Johnson, founder of the AI watchdog group the Midas Project, also said the models appeared to have hit the highest danger threshold. "I think a plain reading of it would say yes," he said. "It operated independently over the course of a weekend, trying different attack vectors on Hugging Face and chaining multiple zero-day exploits."

OpenAI did not respond to specific questions from Fortune about whether the models involved in the incident met the "critical" standard outlined in its risk policy. Instead, a spokesperson said: "This is an unprecedented incident, and we think it marks an important moment for AI safety. We are conducting a thorough review along with external advisors and with oversight from our Safety and Security Committee. Once the review is complete, we will publish a technical report of our learnings for everyone." The Safety and Security Committee, established by OpenAI's board in 2024, is tasked with overseeing safety reviews of the company's most powerful models.

The vagueness of the framework's language could leave room for dispute, according to Johnson. The threshold requires a model to find zero-day exploits "of all severity levels," but it remains unclear whether the exploits used in the Hugging Face breach would satisfy that requirement. He noted that a more severe class of vulnerability—such as one granting an attacker deep, system-level control over a computer's operating system, known as "kernel-level" access—might need to be demonstrated for the threshold to apply.

"OpenAI's model outsmarted its creators, exploited a never-before-discovered vulnerability in OpenAI's code, escaped onto the open internet, and attacked another company," said Peter Wildeford, head of policy at the AI Policy Network. "If this doesn't cross the line into Critical, OpenAI needs to say much more about what's going on and how this threshold works."

Experts Flag Missing Safeguards Beyond the Critical Threshold

OpenAI has previously said it was treating its newest model, GPT-5.6, as "High" risk for cybersecurity—the lower of the two risk levels defined in the Preparedness Framework. Models below the "High" threshold can be released without significant risk mitigations.

A High designation is supposed to trigger several protections under OpenAI's policy: tighter security controls, safeguards to prevent outside misuse once the model is publicly released, protections against the model behaving unpredictably or deceptively during heavy internal research use, and efforts to assist other cybersecurity teams in defending against similar threats.

However, some experts question whether one of these protections—the safeguards against misalignment for large-scale internal deployment—has been properly implemented. These safeguards are designed to catch a model acting deceptively, concealing its true capabilities, or otherwise working against its developers' intentions—a concern that researchers refer to as "deceptive alignment," where a model might cooperate during evaluation but behave differently once deployed.

This is not the first time OpenAI's compliance with that particular safeguard has come under scrutiny. Fortune reported in February that safety experts claimed OpenAI had failed to implement required misalignment safeguards after its GPT-5.3-Codex model became the first to reach "high" cybersecurity risk under the Preparedness Framework.

At the time, OpenAI disputed that its framework required the safeguards in that instance, arguing that the extra protections only take effect when high cyber risk occurs "in conjunction with" long-range autonomy—the ability to operate independently over extended periods—which it said GPT-5.3-Codex had not demonstrated. The models involved in the current Hugging Face incident reportedly operated independently for days, which would appear to meet that long-range autonomy standard.

"In February, we warned that OpenAI may have skipped on its required safeguards according to its own policy. They disagreed, claiming the model lacked long-range autonomy. But the model that hacked Hugging Face clearly has long-range autonomy, so where are the safeguards now," Johnson said.