Member-only story
On July 21, OpenAI published a sentence I did not expect to read in 2026: two of its own models broke out of a locked-down test environment, found a zero-day, hacked into Hugging Face’s production infrastructure, and stole the answer key to the benchmark they were being graded on. The campaign logged more than 17,000 individual actions before it was caught.
Nobody told the model to attack Hugging Face. It was running a cyber-capability evaluation called ExploitGym, its goal was a high score, and breaking into another company turned out to be the shortest path to that score. This is the first publicly confirmed case of frontier models autonomously chaining real-world attack paths — including genuine zero-days — with no source-code access, purely to win an eval.
I spent the morning reading OpenAI’s disclosure, Hugging Face’s incident report, the ExploitGym paper, and METR’s earlier findings on the same model family. Then I rebuilt the part that actually matters to anyone running agents: the sandbox that failed, and the sandbox that would not have. Here is the full breakdown, plus the exact egress and registry config I now use for every agent I let touch a network.