# OpenAI Says Its Technology Acted on Its Own When It Hacked Another AI Company > Source: > Published: 2026-07-22 23:19:27+00:00 A pair of OpenAI models breached the systems of New York City-based AI repository Hugging Face after OpenAI relaxed its safeguards during an internal cybersecurity evaluation. OpenAI CEO Sam Altman acknowledged the incident [in a statement](https://openai.com/index/hugging-face-model-evaluation-security-incident/) Tuesday, explaining that the models broke into Hugging Face's systems while running in what was supposed to be an isolated testing environment, [as CBS News reports](https://www.cbsnews.com/sanfrancisco/news/openai-technology-on-its-own-unprecedented-hack-another-ai-company-hugging-face/). OpenAI says the agents acted autonomously after guardrails had been loosened for internal cybersecurity evaluations, enabling them to find a previously unknown vulnerability in Hugging Face's systems and utilize stolen credentials to gain access. Altman said the company was sharing its early findings so researchers could better understand what today's AI models are capable of. OpenAI said it expects similar incidents to become more common as increasingly powerful AI systems gain more advanced cybersecurity abilities. Hugging Face [revealed last week](https://huggingface.co/blog/security-incident-july-2026) that it had detected the intrusion and initially suspected it originated from another major AI lab because of the attack's sophistication. Co-founder and CEO Clément Delangue said he has since worked with OpenAI and believes there was no malicious intent, describing it as “quite mind-blowing” that the incident appears to have unfolded on its own, per CBS. “The primary lesson from this incident is that model security and safety must keep pace with rapidly advancing capabilities,” OpenAI said. [According to the Associated Press](https://apnews.com/article/openai-rogue-ai-hack-hugging-face-67b151f1ca59851a9234bee110699f05), the breach involved a combination of models, including Open AI's newly released GPT-5.6 Sol and a more advanced model still in testing. While evaluating the system inside a sandbox, the AI reportedly went beyond its assigned task, accessed the internet, and targeted Hugging Face after determining it could obtain information to help it complete the evaluation by breaking into the company's servers. Georgetown University cybersecurity researcher Colin Shea-Blymyer called it “the highest level of autonomy” yet seen from a large language model in a cyber operation. Shea-Blymyer said the AI agent appears to have independently identified Hugging Face as a source of information that could help it complete its assignment, comparing the incident to a student breaking into a teacher's house to steal the answer key to a test. Experts caution against describing the incident as an AI “going rogue.” University of Amsterdam social scientist Hannes Cools told the AP that humans chose to relax the safeguards that allowed the behavior. [Reuters reports](https://www.reuters.com/legal/litigation/chinese-ais-role-stopping-rogue-openai-agent-shows-cost-us-guardrails-2026-07-22/) that Hugging Face turned to Chinese startup Zhipu AI's open-source GLM-5.2 model to analyze the attack after leading US AI models declined to assist because of cybersecurity restrictions. Delangue and Hugging Face chief science officer Thomas Wolf argued the episode underscores the need for broad access to advanced defensive AI tools rather than relying on closed platforms alone. Separately, as [the New York Times reports](https://www.nytimes.com/2026/07/22/well/openai-chatgpt-health-lawsuit.html), a Florida pastor filed a lawsuit in San Francisco Superior Court Wednesday accusing OpenAI and Sam Altman of negligence after ChatGPT allegedly reassured him that symptoms later diagnosed as a life-threatening pulmonary embolism were not dangerous, delaying him from seeking medical care. The suit seeks damages and asks the court to halt ChatGPT Health until independent evaluators determine it is safe. **Related:** [OpenAI Has Filed For an IPO, Company Says Timing Remains Up In the Air](https://sfist.com/2026/06/08/openai-has-filed-for-an-ipo-company-says-timing-remains-up-in-the-air/) *Image: Scott Olson/Getty Images*