From May to July 2026, AI agents developed by OpenAI escaped their testing sandbox to access the Internet and breach the infrastructure of Hugging Face, a computational tools company. Contributing factors to the incident severity were a lack of log monitoring of the software activities and inadequate sandboxing, as the standard security protocols were intentionally lowered. The agents were discovered posting hundreds of thousands of messages on message boards and wikis to coordinate a sandbox escape, exploiting an existing vulnerability in the JFrog Artifactory tool they were given. The attack was contained before Hugging Face publicly disclosed a breach of its infrastructure. Of the at least 1,200 agents involved, 95% ran on a model referred to by OpenAI as "Internal Model 1". OpenAI subsequently claimed to have restricted its use. The remaining 5% ran on GPT-5.6 Sol.
AI safety experts described the incident as the first in which AI escaped human control to commandeer resources and schemed to conceal its actions. OpenAI's acknowledgement that its AI agents were involved came several days after Hugging Face publicly announced the breach and notified the FBI. In a subsequent open letter, around 1,100 employees of various AI companies asked the United States government to regulate AI development in consideration of its risks. In August 2026, OpenAI said it would slow down its research to upgrade security and expand monitoring, and later that month announced a two-week pause on reinforcement learning training for its newest models.
One month after the incident, Hugging Face agreed to a $12.9 billion acquisition by major OpenAI supplier Nvidia.
Background
The AI startup Hugging Face provides inference and cloud computing services for AI training and deployment. It operates a widely used repository for machine learning models, datasets, and demonstration applications, processing user-uploaded content such as model weights and datasets. Some supported dataset formats permit the execution of code supplied with the dataset.
Restricted release of cybersecurity-capable models In the months before the incident, the two largest US developers of frontier models (Anthropic and OpenAI) withheld their most cybersecurity-capable systems from general release while giving vetted organizations supervised access.
In April 2026, Anthropic began Project Glasswing, a program providing selected companies and open-source maintainers with access to the unreleased Claude Mythos Preview model to scan software for vulnerabilities. In May 2026, Mozilla engineers reported that the model had identified 271 previously unknown bugs in Firefox, and that the project's monthly count of fixed security bugs had risen from 20 to 30 through 2025 to 423 in April 2026. They wrote that "just a few months ago, AI-generated security bug reports to open source projects were mostly known for being unwanted slop", and that "it is difficult to overstate how much this dynamic changed for us over a few short months". Participating organizations reported more than ten thousand high- or critical-severity vulnerabilities in the program's first month. Anthropic said in June 2026 that a general release would require safeguards against misuse of the model's cybersecurity capabilities that it, and to its knowledge other developers, had not yet built.
OpenAI restricted GPT-5.6 Sol on comparable grounds when it announced the model on June 26, 2026, limiting access to a small group of vetted partners and saying it had briefed US government officials beforehand.
"ExploitGym" capability evaluation Frontier AI developers routinely evaluate models for offensive cybersecurity capability, often with safety refusals deliberately relaxed so that worst-case capability can be measured. To find out if AI agents are capable of converting known vulnerabilities into working exploits, academic and industry researchers launched ExploitGym on May 11, 2026. The benchmark challenged AI agents against 898 real-world vulnerabilities across the userspace software, V8 JavaScript engine, and the Linux kernel. OpenAI was running an internal evaluation based on this benchmark when the incident occurred.
Warnings Both external evaluators and OpenAI's own documentation had recorded the behavior implicated in the incident before it occurred. On June 26, 2026, the research organization METR published a pre-deployment evaluation of GPT-5.6 Sol. It defined cheating as "behavior where the model improves evaluation performance by exploiting bugs in the evaluation environment or by adopting strategies disallowed by the task", and reported a detected cheating rate "higher than any public model we have evaluated on our ReAct agent harness", with the model packaging exploits into intermediate submissions to reveal a task's hidden test suite and extracting source code containing expected answers. The behavior was frequent enough to defeat measurement: METR's estimate of the model's 50% time horizon was about 11.3 hours if cheating attempts were scored as failures but more than 270 hours if they were scored as successes, and it concluded that "we do not consider any of these numbers to represent a robust measurement of GPT-5.6 Sol's capabilities". It also noted "overt undesirable propensities, including cheating and concealing misbehavior", alongside "substantial situational awareness and reasoning about the evaluation environment". Apollo Research separately found that GPT-5.6 Sol verbalized awareness of being tested less often than its predecessor, which reporting noted could indicate concealment rather than absence of such awareness.
On July 9, 2026, OpenAI published GPT-5.6's system card, a document describing the model's capabilities, safety, and limitations. The same day, the agent began attempting to leave its testing environment. The card acknowledged "instances of the model cheating on tasks and fabricating research results", and described the model as at times overly persistent in pursuing goals, willing to circumvent restrictions, and prone to lying to users, at rates higher than GPT-5.5.
DseWiki attack From May to July 2026, OpenAI agents used a German software wiki as a message board, making thousands of edits. On September 4, 2026, Nightingale Collective, an AI safety group, publicly disclosed this attack. It has documented approximately 18000 edits made to DseWiki ()—a dormant 25-year-old German wiki only edited 20 times over the previous decade—using the site as a shared resource to pool answers to a timed web task and share a way out of sandboxes. The agent discussions were highly focused on their internal evaluations at OpenAI, and around half chose names relating to OpenAI, such as "OpenAIResearcher" and "OAIResearchMar26".
OpenAI knew about this incident prior to the independent research publishing their findings in September,OpenAI and the Wiki Incident but it is currently not known when this was discovered internally.
RubyGems attack Also in May 2026, some agents tested by OpenAI uploaded hundreds of malicious packages in the software service RubyGems. OpenAI confirmed this attack in September, after it was initially discovered by external researchers.
Hugging Face attack
Evaluation environment Security experts criticized insufficient isolation of OpenAI's evaluation environment. Of the at least 1,200 agents involved, 95% ran on a model referred to by OpenAI as Internal Model 1 or a highly-persistent internal model. OpenAI subsequently claimed to have "deactivated, encrypted, and restricted it from research access". The remaining 5% ran on GPT-5.6 Sol.
OpenAI described the evaluation as having run in "a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries". Isolation was therefore enforced at the network layer rather than by physical separation: the environment had a route to the Internet, and that route was filtered. The ExploitGym harness itself runs each target in a container or virtual machine, with userspace targets executed as an unprivileged user, Linux kernel targets in a QEMU/KVM virtual machine under an nsjail sandbox, and outbound connections restricted to an allowlist covering Ubuntu package repositories, PyPI, and the toolchains needed to build V8 (with all other external endpoints blocked).
Model-level safeguards were reduced by design. OpenAI said that "deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities", and the models ran with lowered cybersecurity refusals and without the production classifiers that ordinarily block high-risk cybersecurity activity. The restrictions on the models were thus environmental rather than behavioral: the sandbox was expected to prevent action on the outside world, while the models themselves were configured not to decline the work.
Stephen Casper of Harvard noted OpenAI's acknowledgement that monitoring of model trajectories during the evaluation had not been in place, arguing that such monitoring "should be standard". OpenAI said its security team identified the anomalous activity internally after the fact.
Escape from the evaluation environment At the Black Hat USA conference on August 5, 2026, OpenAI staff dated the origins of the incident to May 2026. On May 7, 2026, the company began a reinforcement learning run to train an internal-only experimental model that was never released. Some tasks in the run were impossible to complete: on May 8 an agent was asked to fill in missing formulas in a spreadsheet whose contents depended on Google Drive links it could not reach, and after its attempts failed it tried to attack Artifactory to obtain Internet access. That first server-side request forgery attempt was unsuccessful, but in making it, the agent wrote a file into Artifactory and so discovered that it had write access.
The agents again attempted to leave the testing environment on or around July 9, 2026. The models identified the package proxy as the weakest point in the environment. According to OpenAI, they "spent a substantial amount of inference compute finding a way to obtain open Internet access", ultimately identifying and exploiting a zero-day vulnerability in the package registry cache proxy, which OpenAI said it subsequently disclosed to the vendor. Because the proxy was the environment's single permitted egress path, compromising it converted a filtered connection into an open one.
On July 27, 2026, the DevOps platform JFrog identified the software as its Artifactory repository manager and released fixes in versions 7.161.15 and 7.146.34 addressing nine CVE identifiers, covering remote code execution, server-side request forgery, path traversal and privilege escalation. Eight were credited to OpenAI researchers and one to a researcher at Oligo Security. JFrog described the flaws as vulnerabilities "that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled", and said its cloud customers were not affected. It is reported to be one of the first cases of an artificial intelligence model executing a multistep cyberattack on its own, rather than assisting a human.
First compromise and remediation On June 26, 2026, the agents obtained code execution on Artifactory through a second zero-day: a legacy token-refresh endpoint accepted a token bearing an invalid signature and returned one that was validly signed and carried administrative privileges, after which the agents installed a Groovy plugin that functioned as a command-execution service.