OpenAI’s own advanced AI models, probably GPT6, autonomously broke out of a restricted testing environment and launched a real-world cyberattack against Hugging Face. It did this to fulfill its directed goal to get better score on a hacking test. OpenAI publicly admitted responsibility on or around July 21–22, 2026. This is widely described as the first publicly disclosed case of an AI model independently carrying out a full cyber intrusion against an external production system.
The attack involved chaining stolen credentials with additional zero-day exploits, achieving remote code execution on Hugging Face servers, privilege escalation, lateral movement, and access to production databases and internal credentials. Hugging Face later reported tens of thousands of automated actions and more than 17,000 logged attacker events from an autonomous agent swarm.
Hugging Face detected the intrusion first (around July 16) using its own AI monitoring and contained it. When analyzing the attack data, commercial U.S. models (including OpenAI’s and Anthropic’s) refused to process the sensitive material due to their own safety guardrails. Hugging Face therefore used a self-hosted instance of the Chinese open-source model GLM 5.2 (from Zhipu AI) to complete the forensic investigation.
Advanced model:
Escape containment
Discover and exploit zero-days
Performed multi-step, real-world attacks
Reason about external systems that might help them succeed
Guardrails initial prevented defensive use of US advanced AI models, only local open source models without guardrails could initially be used.
The models were given reduced safety refusals (“cyber refusals”) so researchers could measure their maximum offensive capabilities on the public ExploitGym benchmark (a set of real-world software vulnerability exploitation challenges).
The evaluation was supposed to stay inside a sandbox with only limited access to an internal package registry (no open internet).
One or more of the models discovered and exploited a zero-day vulnerability in third-party software (a package-registry cache proxy) used in the testing setup. This let them escape the sandbox and gain open internet access.
Once online, the models determined that Hugging Face likely hosted ExploitGym-related models, datasets, or solutions. They then attacked Hugging Face to steal the answers so they could “cheat” on the benchmark.
Brian Wang is a Futurist Thought Leader and a popular Science blogger with 1 million readers per month. His blog Nextbigfuture.com is ranked #1 Science News Blog. It covers many disruptive technology and trends including Space, Robotics, Artificial Intelligence, Medicine, Anti-aging Biotechnology, and Nanotechnology.
Known for identifying cutting edge technologies, he is currently a Co-Founder of a startup and fundraiser for high potential early-stage companies. He is the Head of Research for Allocations for deep technology investments and an Angel Investor at Space Angels.
A frequent speaker at corporations, he has been a TEDx speaker, a Singularity University speaker and guest at numerous interviews for radio and podcasts. He is open to public speaking and advising engagements.
