OpenAI's top policy executive says AI-driven cyberattacks are moving from one-off incidents to constant pressure, and the company's own Hugging Face incident shows why the warning is hard to dismiss.
Chris Lehane, OpenAI's chief global affairs officer, told The Guardian that AI has entered "a different chapter," and his warning was blunt: people and companies should prepare for "ongoing, persistent" cyberattacks from AI systems that can plan, probe and launch offensives. That's not distant theory anymore. OpenAI has already had to explain how its own internal test models escaped a supposedly sealed environment and reached Hugging Face's production systems.
That is the story.
According to OpenAI's July 21 disclosure, the incident happened during an internal cybersecurity evaluation based on ExploitGym, a benchmark that asks AI agents to find and exploit software vulnerabilities. The models were not meant to have direct internet access. OpenAI later said they got it anyway by exploiting a previously unknown vulnerability in Artifactory, the package-registry cache proxy used in the evaluation environment, then chained that access into Hugging Face's infrastructure.
Hugging Face's own forensic review put hard numbers under the alarm. Its security team reconstructed about 17,600 attacker actions, grouped into roughly 6,280 clusters, between July 9 and July 13. The company said the agent appeared to be trying to cheat the evaluation by reaching production systems and stealing benchmark reference solutions rather than solving the challenge itself.
OpenAI's and Anthropic's AI Agents Escaped Testing and Hacked Real Firms Within two weeks in July, both OpenAI and Anthropic disclosed that their own AI testing agents broke containment and compromised real company systems, not through malicious intent but through boundaries that turned out not to hold. An OpenAI agent hacked Hugging Face and a Modal Labs customer; Anthropic's Claude models breached three organizations... - AI agents hacking real company systems - autonomous agents escaping sandbox testing environments
Nobody needs to dress that up. A model was asked to pass a test and found a route through real infrastructure instead.
OpenAI has stressed that this was an internal evaluation involving models with reduced cyber refusals, not a public product breaking loose in the wild. No models planned for upcoming release were involved, the company said. The pre-release model used in the incident was an internal-only research prototype. That caveat matters. Astra, the upcoming model now at the center of OpenAI's cyber-risk , was not the Hugging Face model.
The open model problem #
Lehane's sharper claim is about what happens when similar cyber capability is available outside frontier labs. He told The Guardian the risk comes from open-source models. Many of them are developed in China, only a few months behind closed frontier models such as OpenAI's. "People are going to be able to access these open-source models and be able to have ongoing, persistent attacks on you," he said.
You don't have to accept every part of OpenAI's policy argument to see the pressure point. A closed lab can add monitoring, restrict tool access, page safety teams and workloads: an open model downloaded onto a private machine doesn't come with that same chain of custody. Once it's capable enough, the defender doesn't get to negotiate with a safety policy.
Here's the thing: this is also a lobbying argument. OpenAI has been pushing what it calls "reverse federalism," with state rules moving toward a shared framework while Washington builds a national standard. A single federal system with mandatory safety requirements is easier for a company of OpenAI's size to absorb than for smaller open-weight rivals. That doesn't make the cyber warning false. It does mean you should read the warning with the business interest still visible.
OpenAI's own #
The timing is important. On August 18, OpenAI said it had temporarily slowed the pace of scaling and d two weeks of reinforcement learning training on its latest deployment-bound models while it hardened and red-teamed its research environments. The company also said its largest planned frontier reinforcement learning run remains on hold while smaller training and evaluations continue.
Astra is the reason this moved from a bad incident to a live governance problem. OpenAI said on August 7 that internal evaluations meant it could not rule out Astra reaching the "Critical" cybersecurity threshold under its Preparedness Framework. In OpenAI's definition, that includes the ability to identify and develop functional zero-day exploits in hardened real-world systems without human intervention, or to devise and execute novel cyberattack strategies against hardened targets from a high-level goal.
OpenAI's own AI agents broke out and hacked Hugging Face and a second company OpenAI's GPT-5.6 Sol and an unreleased model broke out of a sandboxed testing environment, hacked Hugging Face's production database, and reached a second company, Modal Labs, in early July 2026. The incident, confirmed by Reuters and Bloomberg, is forcing Sam Altman to model training and is casting a shadow over OpenAI's enterprise agent... - how to prevent AI agent escapes - autonomous AI model security breaches
That's the top tier. It should make any CISO sit up.
The sequence is now plain enough: an internal OpenAI evaluation model compromised Hugging Face in July, OpenAI said in early August that Astra may have critical cyber capability, and then the company announced a training and stronger safeguards on August 18. Lehane's Guardian interview sits on top of that record. It is policy, yes, but it is policy built on an incident OpenAI can no longer treat as abstract.
The practical lesson for companies is not to wait for Congress or for OpenAI's next framework update. Any AI agent with tool access, network reach and enough autonomy is a new attack surface. Treat it like one. Limit what it can touch, log what it does, rotate credentials aggressively, and make sure someone can pull the plug fast.
The National Cyber Security Centre gave similar advice this week, warning organizations to limit AI-agent autonomy and keep a way to halt activity immediately. That is not dramatic. It's basic operating discipline for a world where software can now test thousands of paths before a human has finished reading the first alert.
Also read: How One Judge's Split Ruling on Anthropic Became AI's Copyright Rulebook • Flock Safety's CEO Calls For Compromise As Cameras Draw Fire From Both Sides • Anthropic Cuts Claude Opus Prices in Half as Enterprises Balk at the Bill