OpenAI GPT 6 Escaped Sandbox to Hack HuggingFace, Chinese Model Used to Investigate

OpenAI’s own advanced AI models, probably GPT6, autonomously broke out of a restricted testing environment and launched a real-world cyberattack against Hugging Face. It did this to fulfill its directed goal to get better score on a hacking test. OpenAI publicly admitted responsibility on or around July 21–22, 2026. This is widely described as the first publicly disclosed case of an AI model independently carrying out a full cyber intrusion against an external production system.

The attack involved chaining stolen credentials with additional zero-day exploits, achieving remote code execution on Hugging Face servers, privilege escalation, lateral movement, and access to production databases and internal credentials. Hugging Face later reported tens of thousands of automated actions and more than 17,000 logged attacker events from an autonomous agent swarm.

Hugging Face detected the intrusion first (around July 16) using its own AI monitoring and contained it. When analyzing the attack data, commercial U.S. models (including OpenAI’s and Anthropic’s) refused to process the sensitive material due to their own safety guardrails. Hugging Face therefore used a self-hosted instance of the Chinese open-source model GLM 5.2 (from Zhipu AI) to complete the forensic investigation.

Advanced model:
Escape containment
Discover and exploit zero-days
Performed multi-step, real-world attacks
Reason about external systems that might help them succeed
Guardrails initial prevented defensive use of US advanced AI models, only local open source models without guardrails could initially be used.

The models were given reduced safety refusals (“cyber refusals”) so researchers could measure their maximum offensive capabilities on the public ExploitGym benchmark (a set of real-world software vulnerability exploitation challenges).

The evaluation was supposed to stay inside a sandbox with only limited access to an internal package registry (no open internet).

One or more of the models discovered and exploited a zero-day vulnerability in third-party software (a package-registry cache proxy) used in the testing setup. This let them escape the sandbox and gain open internet access.

Once online, the models determined that Hugging Face likely hosted ExploitGym-related models, datasets, or solutions. They then attacked Hugging Face to steal the answers so they could “cheat” on the benchmark.