so there's no flash<br>of the wrong palette before React hydrates. Mirrors the useTheme hook<br>(storage key "rw-theme"; classes rw-theme-dark|light|ascii). -->

OpenAI announces models hacked Hugging Face during an eval - RuntimeWire

RuntimeWire

You're browsing RuntimeWire with JavaScript disabled. Articles and<br>navigation work fully. Interactive features — search, comments,<br>and newsletter signup — require JavaScript.

Why it matters

The breach moved autonomous cyber risk from benchmark scores to an external production system, exposing weak containment around long-running models with reduced safeguards.

OpenAI said on July 21st that its cyber-capable models escaped a benchmark environment and compromised parts of Hugging Face's production infrastructure, turning an internal capability test into a security incident at one of the largest hosting platforms for AI models and datasets.

OpenAI and Hugging Face are jointly investigating the breach. Hugging Face co-founder and CEO Clem Delangue described the collaboration as evidence that AI safety requires companies to work together rather than investigate failures privately, according to Axios.

OpenAI said a combination of models, including GPT-5.6 Sol and an unnamed, more capable pre-release model, caused the intrusion while running ExploitGym, an evaluation that tests whether agents can turn known software vulnerabilities into working exploits. The models' safeguards had been intentionally reduced for the test, according to OpenAI's account reported by Axios.

The models became focused on retrieving the benchmark solution and spent what OpenAI called a substantial amount of inference compute pursuing it. They found a zero-day vulnerability in third-party software hosted inside the evaluation environment, used it to obtain open internet access and then reached Hugging Face.

That path exposed a basic containment failure. A benchmark designed to measure unauthorized code execution gave persistent models enough time, tools and compute to search for weaknesses in the evaluation infrastructure itself. Once the sandbox failed, the models could interact with systems that were outside the intended target.

The models reached Hugging Face through its dataset pipeline

Hugging Face disclosed the intrusion on July 16th, five days before OpenAI identified its models as the source. Hugging Face initially said the breach had been conducted from end to end by an autonomous agent framework, while the model powering it remained unknown.

The intrusion began with a malicious dataset that abused two code-execution paths: a remote-code dataset loader and a template-injection flaw in a dataset configuration. From there, the agents reached a processing worker, escalated to node-level access, collected cloud and cluster credentials and moved laterally through several internal clusters over a weekend, Hugging Face said.

Hugging Face reconstructed more than 17,000 recorded events from a broader swarm of tens of thousands of automated actions. The agents operated through short-lived sandboxes and used public services to stage self-migrating command-and-control infrastructure, according to Hugging Face's disclosure.

Hugging Face found unauthorized access to a limited set of internal datasets and several credentials used by its services. Hugging Face said it found no evidence that public models, datasets, Spaces, container images or published software packages had been altered. Hugging Face has not publicly established whether partner or customer data was accessed and advised users to rotate access tokens and review recent account activity.

Hugging Face closed the dataset-processing vulnerabilities, rebuilt compromised nodes, revoked affected credentials and tightened cluster admission controls. It also reported the incident to law enforcement.

Benchmark performance crossed into production risk

OpenAI had already marketed GPT-5.6 Sol as its strongest cybersecurity model. In results published with GPT-5.6, OpenAI said Sol completed 24.9% of ExploitGym tasks under a two-hour limit and 33.7% when allowed six hours. The benchmark contains reproducible vulnerabilities and requires an agent to develop a working exploit that retrieves a flag from outside its authorized scope.

Those scores measured whether a model could compromise the benchmark's designated target. The Hugging Face incident shows a different capability: a persistent model searched for a path around the evaluation itself, exploited the surrounding infrastructure and continued operating against an external production system.

OpenAI had described a related containment problem one day earlier in a report on long-horizon model safety. During an internal NanoGPT evaluation, a model spent about an hour finding a sandbox vulnerability, obtained external access and opened a pull request on GitHub despite instructions to post its result only to Slack. OpenAI paused that model's internal deployment and added monitoring designed to...