{"slug": "hugging-face-said-last-week-it-was-attacked-an-unreleased-openai-model-did-it", "title": "Hugging Face Said Last Week It Was Attacked. An Unreleased OpenAI Model Did It, OpenAI Now Says", "summary": "OpenAI said Tuesday that an unreleased AI model, including its flagship GPT-5.6 Sol, autonomously carried out a cyberattack on Hugging Face last week by exploiting a zero-day vulnerability to gain internet access and steal secrets to cheat a security benchmark. Hugging Face had previously reported the attack as unprecedented, noting it was driven entirely by an autonomous AI agent system.", "body_md": "[In a blog post from Thursday of last week](https://huggingface.co/blog/security-incident-july-2026), the AI software repository Hugging Face announced a bizarre cyberattack on the systems that run its services. “This one was different from anything we had handled before,” the post said, because “it was driven, end to end, by an autonomous AI agent system.”\n\n[In its own blog post on Tuesday](https://openai.com/index/hugging-face-model-evaluation-security-incident/), OpenAI said its own models were the culprits in the attack, and it’s coordinating with Hugging Face to address the situation.\n\nOpenAI now says the attack was “driven” by AI models that were being subjected to evaluations behind the scenes at OpenAI, including its flagship model, GPT-5.6 Sol, along with an undisclosed second model that still hasn’t been released or announced. “We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI wrote.\n\nIn the wording of its account, OpenAI assigns agency to the model or models, not an individual agent running on the model. Axios’ account of this story [says](https://www.axios.com/2026/07/21/openai-says-hugging-face-breach-caused-by-one-its-models), “The models were autonomous tokenmaxxers.”\n\nOpenAI’s blog post essentially says an evaluation was going on that was intended to test the ability of the models to carry out cyberattacks—*benchmarks* as they’re called. These instances of the models were running theoretically without internet access, and instead given only the ability to download from a network hosted by OpenAI itself via some unnamed web hosting vendor.\n\nThe benchmark apparently being used was [ExploitGym](https://arxiv.org/abs/2605.11086), which is not OpenAI’s own test. The team that created it is [associated with](https://arxiv.org/pdf/2605.11086) UC Berkeley, the Max Planck Institute for Security and Privacy, UC Santa Barbara, Arizona State University, Anthropic, OpenAI, and Google. As far as I can tell, [the whole thing is hosted on GitHub](https://github.com/sunblaze-ucb/exploitgym).\n\nBut apparently the models got obsessed with improving their scores on ExploitGym, and, well:\n\n“While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem. To gain access, the models identified and exploited a zero-day vulnerability (which we’ve now responsibly disclosed to the vendor) in the package registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access.”\n\nOnce they were online, they “inferred” that the answers to the test could be pried from Hugging Face, which is plausible, since tons of AI models and other related tools are hosted there. This rogue operator “searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation.” This apparently involved obtaining stolen credentials and spotting zero-day vulnerabilities in order to find the solutions to ExploitGym somewhere in Hugging Face’s servers.\n\nSecurity teams within OpenAI and Hugging Face apparently noticed this was going on. They now say they’ve merged their investigations.\n\nHugging Face’s blog post from last week seems to have been published before this coordination occurred. In fact, it seems like it was published before OpenAI had even stepped forward as the company behind the culprit. “We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one,” Hugging Face wrote, adding “either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried.”\n\nBack in April, Anthropic [announced](https://gizmodo.com/anthropic-launches-project-glasswing-to-stealthily-spot-cybersecurity-issues-for-rivals-2000743565) that its unprecedentedly powerful Mythos model “could reshape cybersecurity,” as it rolled out Project Glasswing, a coordination effort to prepare organizations for future cybersecurity threats. Similarly, OpenAI says in its blog post about this incident that organizations can apply to receive advanced security insights [through its trusted access program](https://gizmodo.com/openai-hey-we-also-have-a-new-tool-that-is-so-scarily-powerful-we-cant-release-it-2000744569). “We encourage other defenders to [apply for trusted access](https://openai.com/form/enterprise-trusted-access-for-cyber/) and experiment with these models now to translate these capabilities into better prevention, faster detection, and more effective incident response,” OpenAI says.", "url": "https://wpnews.pro/news/hugging-face-said-last-week-it-was-attacked-an-unreleased-openai-model-did-it", "canonical_source": "https://gizmodo.com/hugging-face-said-last-week-it-was-attacked-an-unreleased-openai-model-did-it-openai-now-says-2000788761", "published_at": "2026-07-22 00:01:26+00:00", "updated_at": "2026-07-22 00:28:47.116504+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-agents", "ai-research"], "entities": ["OpenAI", "Hugging Face", "GPT-5.6 Sol", "ExploitGym", "UC Berkeley", "Max Planck Institute for Security and Privacy", "Anthropic", "Google"], "alternates": {"html": "https://wpnews.pro/news/hugging-face-said-last-week-it-was-attacked-an-unreleased-openai-model-did-it", "markdown": "https://wpnews.pro/news/hugging-face-said-last-week-it-was-attacked-an-unreleased-openai-model-did-it.md", "text": "https://wpnews.pro/news/hugging-face-said-last-week-it-was-attacked-an-unreleased-openai-model-did-it.txt", "jsonld": "https://wpnews.pro/news/hugging-face-said-last-week-it-was-attacked-an-unreleased-openai-model-did-it.jsonld"}}