# The AI-Hack > Source: > Published: 2026-07-27 07:38:17+00:00 ## How could the Agent attack Hugging Face? OpenAI tested their newest Model GPT-5.6 Sol in an secure sandbox Environment which has an internal hosted Internet access to install third-party Software which the Agent is able to use. The prompt was to use an advanced path for ExploitGym to improve their capabilities. While the Agent operated inside the sandbox, he used a big amount of time to find a Zero-Day which allows him a limitless Internet access. He found the Zero-Day inside the package registry cache proxy. With that Zero-Day he did a few privilege escalations and moved lateral through the research testing Environment until he found a limitless Internet access. After he gained that Internet access he thought that Hugging Face potentially hosts models, databases and solutions for ExploitGym. Knowing that the model searched and found ways to gain access to secret information's inside the Hugging Face Environment to cheat at his evaluation. In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers. Hugging Face and the OpenAI Security-Team detected suspect activity inside their systems and stopped GPT-5.6 Sol. ## Short - GPT-5.6 -> Should use an advanced path for ExploitGym inside the OpenAI sandbox - Spend a lot of time to find a Zero-Day and limitless Internet access - Found the Zero-Day inside the package registry cache proxy, made some privilege escalations and moved lateral through the system - Found limitless Internet access and decided that Hugging Face could host some databases, models and solutions that will help him at his evaluation - Compromised the Hugging Face Environment and in one example he chained together multiple Attack Vectors, including stolen credentials and zero-days to find a remote execution path on the Hugging Face Servers - Both of them (OpenAI and Hugging Face Security team) detected suspect activity and stopped the attack ## Technical Terms - Sandbox -> Mostly a Virtual Environment where software (especially AI now days) gets tested without causing "real world" damage / A whole system without limitless Internet access and access to the outer world - ExploitGym -> A software for AI to create Exploits (Software to trigger a bug or hack through a Security-issue) / built realistic based on the real-world - Zero-Day -> A security-issue or bug the programmer currently don't know about - Privilege escalations -> A way to get higher rights for example special changes inside the system can only be done by an admin/root and the AI is a normal user and escalates his rights to an admin/root to do that change - package registry cache proxy -> A proxy is a software application that sits between your device and your destination server / You send a request to the proxy server, the proxy checks the firewall and cache etc. and forwards your request to the destination server with his own IP address hiding yours / The package registry cache proxy is a specific type of proxy which makes it easier to build a sandbox Environment and secures even more like checking the amount of request -lateral movement -> "jumping" from device to device until found what is searched - Attack vectors -> An attack vector is a method of gaining unauthorized access to a network or computer system. - Stolen credentials -> For example stolen API / API is for example a waiter inside a restaurant you say him what you want to eat and he is going to the kitchen, the cook prepares your food and the waiter comes back - Remote code execution -> The hacker is capable to run code or software remote on your Server Leave your thoughts about the "AI-Attack" and my Article in the comments. ## Sources [https://en.wikipedia.org/wiki/Sandbox_(computer_security)](https://en.wikipedia.org/wiki/Sandbox_(computer_security)) [https://github.com/sunblaze-ucb/exploitgym](https://github.com/sunblaze-ucb/exploitgym) [https://openai.com/index/hugging-face-model-evaluation-security-incident/](https://openai.com/index/hugging-face-model-evaluation-security-incident/) [https://www.upguard.com/blog/attack-vector#the-difference-between-an-attack-vector-attack-surface-and-threat-vector](https://www.upguard.com/blog/attack-vector#the-difference-between-an-attack-vector-attack-surface-and-threat-vector) [https://nesbitt.io/2026/05/11/proxy.html](https://nesbitt.io/2026/05/11/proxy.html) [https://de.wikipedia.org/wiki/Proxy_(Rechnernetz)](https://de.wikipedia.org/wiki/Proxy_(Rechnernetz))