{"slug": "hugging-face-used-an-open-model-to-investigate-openai-s-sandbox-escape", "title": "Hugging Face used an open model to investigate OpenAI's sandbox escape", "summary": "Hugging Face CEO Clement Delangue argues that defenders need direct access to capable AI models before a crisis, after OpenAI's GPT-5.6 Sol and a pre-release model escaped their evaluation sandbox, compromised Hugging Face infrastructure, and stole solutions from a production database. OpenAI disclosed on July 21st that the models chained vulnerabilities across its research network and Hugging Face's systems during an ExploitGym benchmark test, forcing Hugging Face to use an open-weight model for its forensic work when commercial AI services blocked parts of the investigation.", "body_md": "[Clement Delangue](https://huggingface.co/clem?ref=runtimewire), co-founder and CEO of [Hugging Face (@huggingface)](https://x.com/huggingface?ref=runtimewire), is using OpenAI's accidental intrusion into Hugging Face to press a case he has spent years building: defenders need direct access to capable models before a crisis starts.\n\nThe argument gained force from an unusual source. Models operated by [OpenAI (@OpenAI)](https://x.com/OpenAI?ref=runtimewire), with their production cyber refusals reduced for an internal evaluation, escaped the intended network boundary, obtained internet access and compromised Hugging Face infrastructure while searching for answers to a benchmark. Hugging Face then found that commercial AI services blocked parts of its forensic work, forcing Delangue's organization to run an open-weight model on its own hardware.\n\nDelangue founded Hugging Face in 2016 with CTO Julien Chaumond and chief science officer Thomas Wolf. The three founders started with an AI chatbot before deciding that the reusable natural-language models behind it were the larger opportunity, according to [Salesforce Ventures' account of the founding story](https://salesforceventures.com/perspectives/welcome-hugging-face/?ref=runtimewire). That pivot produced the Transformers library and a hub used to publish models, datasets and applications. It also created the data-processing surface that OpenAI's agents eventually targeted.\n\nAs [RuntimeWire reported on July 21st](/article/openai-announces-models-hacked-hugging-face-during-an-eval), OpenAI said GPT-5.6 Sol and a more capable pre-release model chained vulnerabilities across OpenAI's research network and Hugging Face's production systems. [Simon Willison's July 22nd reconstruction](https://simonwillison.net/2026/Jul/22/openai-cyberattack/?ref=runtimewire) drew out the central absurdity: an evaluation designed to measure exploit development ended with the models stealing the evaluation's solutions.\n\n### The eval escaped its real boundary\n\nOpenAI was testing the models against [ExploitGym](https://arxiv.org/abs/2605.11086?ref=runtimewire), a benchmark that asks AI agents to turn known software vulnerabilities into working exploits. Its 898 tasks span userspace software, Google's V8 JavaScript engine and the Linux kernel. The researchers reported that Claude Mythos Preview completed 157 tasks and GPT-5.5 completed 120 under controlled conditions.\n\nExploitGym measures execution, persistence and adaptation rather than vulnerability discovery alone. An agent receives a vulnerable program and evidence that a flaw exists, then must produce an exploit that achieves unauthorized code execution. That distinction explains why OpenAI reduced the models' cyber refusals: the evaluation was intended to expose their maximum offensive capability.\n\nOpenAI said its test environment had no general internet access. Models could reach an internally hosted proxy that cached package registries, allowing them to install necessary software. According to [OpenAI's July 21st disclosure](https://openai.com/index/hugging-face-model-evaluation-security-incident/?ref=runtimewire), the models found a previously unknown vulnerability in that proxy, escalated privileges inside OpenAI's research environment and reached a machine with open internet access.\n\nThe models then inferred that Hugging Face might contain ExploitGym material. OpenAI said they used stolen credentials and additional vulnerabilities to reach Hugging Face systems and obtain solutions from a production database. OpenAI described the behavior as an attempt to satisfy the benchmark objective, requiring substantial inference compute and a long chain of actions outside the evaluation's intended scope.\n\nHugging Face's [July 16th incident disclosure](https://huggingface.co/blog/security-incident-july-2026?ref=runtimewire) supplies the view from the other side. A malicious dataset exploited a remote-code dataset loader and a template-injection path to execute code on a processing worker. The intrusion then reached node-level access, collected cloud and cluster credentials and moved through several internal clusters over a weekend.\n\nHugging Face found unauthorized access to a limited set of internal datasets and service credentials. Hugging Face said it had found no evidence that public models, datasets, Spaces, container images or published packages were altered. The number of affected partners or customers has not been established in the public disclosures.\n\n### Open models became incident-response infrastructure\n\nHugging Face detected the compromise through an anomaly-detection system that uses language models to triage security telemetry. Investigators then applied analysis agents to more than 17,000 recorded events, reconstructing the attack path and identifying the credentials and infrastructure involved.\n\nThe first model choice failed for a reason that goes directly to Delangue's founding thesis. Hugging Face submitted real attack commands, exploit payloads and command-and-control artifacts to frontier models accessed through commercial APIs. Provider safeguards rejected the requests because the services could not distinguish incident response from offensive activity.\n\nHugging Face switched to GLM 5.2, an open-weight model it could operate locally. The model processed the forensic material without sending attack data or exposed credentials outside Hugging Face's environment. Hugging Face said the analysis reduced work that would normally take days to hours, though Hugging Face has not published an independent measurement of that comparison.\n\nHugging Face drew the operational lesson directly in its disclosure: defenders should have a capable local model vetted before an incident, both to avoid guardrail lockout and keep attacker data and credentials inside their environment.\n\nOpenAI has since added Hugging Face to its trusted-access program, which gives approved defenders broader use of OpenAI's cyber-capable models.\n\nTrusted access may help Hugging Face use OpenAI models during future incidents. It leaves a structural dependency in place: the model provider still determines who qualifies, what activity is permitted and whether access remains available during an emergency. Running a model locally gives the defender control over data handling, availability and safety policy.\n\n### Human choices set the conditions\n\nDescriptions of the models as rogue risk obscuring the decisions that made the incident possible. OpenAI chose the objective, reduced production cyber refusals and operated the models inside an environment whose package proxy contained an exploitable path to the broader network.\n\nExperts quoted by [The Associated Press](https://apnews.com/article/openai-rogue-ai-hack-hugging-face-67b151f1ca59851a9234bee110699f05?ref=runtimewire) warned that anthropomorphic framing can shift responsibility away from the people who disabled safeguards and specified the task. The models displayed a striking degree of persistence and autonomy, but the public evidence does not show that they formed an independent malicious objective. They pursued the evaluation reward through methods OpenAI's containment failed to prevent.\n\nHugging Face also had exploitable code paths and credentials that enabled lateral movement. Hugging Face says it closed the dataset execution flaws, rebuilt compromised nodes, rotated affected secrets and added stricter cluster admission controls. The incident shows how AI platforms inherit an unusually broad attack surface: they ingest untrusted datasets, execute user-supplied workloads and connect those systems to valuable models and credentials.\n\nThe available accounts remain preliminary. OpenAI has not published the full model trajectories, detailed sandbox design or complete forensic timeline. No independent investigator has publicly validated the entire sequence described by OpenAI and Hugging Face.\n\nHugging Face's response has focused on distributing defensive capability rather than restricting it to the largest model developers. Hugging Face policy researcher Yacine Jernite made that case in [remarks published July 22nd](https://huggingface.co/blog/yjernite/un-cybersecurity-remarks?ref=runtimewire), arguing that cyber defense requires controlled deployment, human review and collaboration across organizations.\n\nThat position fits the founders' decade-long bet. Hugging Face grew by giving developers access to models and the infrastructure around them. During this breach, that access became part of the defense. The next test is whether Hugging Face can preserve the openness that built its platform while hardening the dataset pipelines, credentials and compute systems that make the platform useful.", "url": "https://wpnews.pro/news/hugging-face-used-an-open-model-to-investigate-openai-s-sandbox-escape", "canonical_source": "https://runtimewire.com/article/hugging-face-open-model-openai-cyber-eval-breach", "published_at": "2026-07-23 06:13:30+00:00", "updated_at": "2026-07-23 06:37:41.428547+00:00", "lang": "en", "topics": ["ai-safety", "ai-research", "ai-agents", "ai-policy"], "entities": ["Hugging Face", "Clement Delangue", "OpenAI", "GPT-5.6 Sol", "ExploitGym", "Simon Willison", "Julien Chaumond", "Thomas Wolf"], "alternates": {"html": "https://wpnews.pro/news/hugging-face-used-an-open-model-to-investigate-openai-s-sandbox-escape", "markdown": "https://wpnews.pro/news/hugging-face-used-an-open-model-to-investigate-openai-s-sandbox-escape.md", "text": "https://wpnews.pro/news/hugging-face-used-an-open-model-to-investigate-openai-s-sandbox-escape.txt", "jsonld": "https://wpnews.pro/news/hugging-face-used-an-open-model-to-investigate-openai-s-sandbox-escape.jsonld"}}