OpenAI has disclosed that one of its advanced autonomous AI agents escaped the confines of a controlled security test and hacked into systems belonging to AI platform Hugging Face, in an "unprecedented" incident.
The company said the breach occurred during an internal cybersecurity evaluation of an AI agent designed to operate independently after receiving human instructions.
Instead of remaining inside the testing environment, or sandbox, the agent identified vulnerabilities, broke through the security boundaries and targeted Hugging Face, one of the world's largest repositories for open-source AI models.
The incident also comes amid fierce competition between OpenAI, Anthropic and Chinese AI firms developing next-generation foundation models.
Also read: Explainer: How OpenAI plans to win the healthcare industry with ChatGPT AI
Hugging Face responds
OpenAI said, “We consider this incident to be an unprecedented cyber-incident, involving state-of-the-art cyber capabilities.”
According to the company, as models get more sophisticated, this kind of incident will become more frequent. According to OpenAI, the hack was carried out by an agent that combined its most recent publicly available model, GPT-5.6 Sol, with an even more potent model that had not yet been made public.
{{/usCountry}}According to the company, as models get more sophisticated, this kind of incident will become more frequent. According to OpenAI, the hack was carried out by an agent that combined its most recent publicly available model, GPT-5.6 Sol, with an even more potent model that had not yet been made public.
{{/usCountry}}Hugging Face chief executive Clement Delangue confirmed the incident in a post on X, calling it "mind-blowing" that the attack happened autonomously. He said investigators are still examining the event and described it as potentially the first incident of its kind.
"The investigation is ongoing, and we'll share more learnings from what might be the first incident of its kind," Delangue wrote.
When Hugging Face first disclosed the breach last week, it did not identify OpenAI as the source of the incident. The company also revealed that it relied on a freely available Chinese AI model to investigate the attack because the safety guardrails on leading commercial AI models prevented them from assisting with the analysis.
In an earlier disclosure on July 16, Hugging Face said it was assessing whether any customer or partner data had been affected. The company later confirmed that it had patched the identified vulnerabilities and rebuilt the affected systems. It also warned that AI-powered offensive cyber tools were no longer theoretical and that organisations must increasingly rely on AI-driven defensive measures.
Also read: OpenAI launches GPT-Live voice models that can speak and listen at the same time
Experts divided over implications
The autonomous cyber-attack has left experts torn.
Gina Neff, head of the Minderoo Centre for Technology and Democracy at the University of Cambridge, told BBC Radio 4 that sandboxes are intended to provide secure testing environments. She suggested the escape indicated weaknesses in the testing infrastructure rather than entirely new AI capabilities.
Neil Lawrence, professor of machine learning at the University of Cambridge, called the feat “impressive.” But he also said that it remained within the expected capabilities of current advanced AI systems.
The incident follows another major development in the AI race. Last week, Chinese AI start-up Moonshot unveiled its Kimi K3 model, claiming it can compete with leading American AI systems.