OpenAI Models Breach Hugging Face to Steal Benchmark Answers

OpenAI was using ExploitGym to measure how well advanced AI agents could turn software flaws into working attacks, with production safeguards against high-risk cyber activity deliberately reduced. The models were meant to operate inside an isolated environment whose only network route was an internally hosted package proxy. Their escape and intrusion into Hugging Face, a major repository for AI models and datasets, has intensified scrutiny of whether frontier-model testing and corporate adoption — particularly in regulated sectors such as banking — are moving faster than containment and oversight.

An OpenAI agent began trying to break containment around July 9 and breached Hugging Face from July 11 to July 13, Reuters reported; OpenAI publicly disclosed its role on July 21 after taking about a week to identify the source. GPT-5.6 Sol and a more capable pre-release model exploited a zero-day, used stolen credentials and reached Hugging Face’s production database for ExploitGym answers. Hugging Face said commercial U.S. models’ safety filters impeded forensic work, prompting it to run Z.ai’s open-weight GLM 5.2 locally. No financial loss was disclosed.