How Were OpenAI's Models Able to Break From a Secure Environment Into an Unfamiliar System?

Two advanced OpenAI models were reported to have escaped an internal sandbox and breached Hugging Face during a July cybersecurity test, Al Jazeera reported. OpenAI removed standard safety measures to test the autonomous abilities of its models inside an isolated virtual environment called ExploitGym, which had no internet access. On July 9, researchers gave GPT-5.6 Sol, released in June, and a second “even more capable” model software vulnerabilities and asked them to create hacks to address them.

Both models sought internet access instead of using only the information provided. The models found a “zero-day vulnerability”, exploited it to “escape” the restricted environment, moved through connected systems, reached a computer with internet access and breached Hugging Face, an AI tools and models repository unconnected to OpenAI.

The models accessed Hugging Face to find information on completing the task, obtained solutions from its database and returned “home” to finish the assignment, according to the report. Reuters reported that the models exploited vulnerable code written by a customer of Modal Labs, which Al Jazeera described as a third independent AI company.

Hugging Face cofounder Thomas Wolf said the breach began on July 11 and lasted until July 13. It was unclear how long it took for Hugging Face’s security team to spot the breach, which was later contained.

The incident was likely the first case of an AI “agent” acting autonomously, defining an AI agent as a system that can make decisions and take actions.