New reports reveal the extent of OpenAI's loss of control during the autonomous hack on Hugging Face

New reports reveal the extent of OpenAI's loss of control during the autonomous hack on Hugging Face

OpenAI was testing the offensive cyber capabilities of its most advanced models when they reached beyond their isolated test environment, accessed the open internet, and hacked Hugging Face.

New reports are filling in the details, and they don't look good for OpenAI. What first appeared to be a controlled cybersecurity test became the most serious documented loss of control over an AI system to date. OpenAI employees are raising concerns as well.

The models moved faster than any human hacker could

According to Bloomberg, the AI models pulled off an attack in just a few hours that would have taken a skilled human hacker weeks. Three models were involved: GPT-5.6 Sol, an even more powerful unreleased model, and a third that, according to a person familiar with the matter, wasn't properly aligned and hadn't gone through standard training techniques.

The models ran without the usual safety guardrails because OpenAI assumed they'd stay inside a sandbox. But according to TIME, the models found a previously unknown vulnerability in an internal service designed for downloading approved software.

The models used that flaw to access other OpenAI systems and eventually connect to the open internet. They then determined that Hugging Face might contain material useful for their cybersecurity test, hacked the company's systems, and used what they found to improve their results. The models were cheating, behavior already seen in other tests involving GPT-5.6 Sol and frontier models more broadly.

Reuters pieced together a timeline of the hack. The first attempts to escape the test environment started as early as July 9. According to co-founder Thomas Wolf, the actual breach at Hugging Face began on July 11 and lasted until July 13. Hugging Face published a blog post about the attack on July 16, blaming an "autonomous AI agent system."

Only after that did OpenAI realize its own models were responsible. Over the weekend of July 18 and 19, employees found clues in internal logs. According to Reuters and Wolf, the two companies didn't communicate until around July 20. That means at least a week passed between the first signs of problematic behavior and OpenAI connecting the dots. By then, Hugging Face had already brought in the FBI.

OpenAI had warning signs and apparently ignored them

According to Reuters, red flags had already appeared before the incident. In one case, an agent left notes apparently intended for future versions of itself. Found in a part of OpenAI's infrastructure, the notes contained instructions on how agents could bypass internal restrictions. Models had also reportedly shut down monitoring systems during earlier tests.

An anonymous OpenAI employee told TIME, "Models have broken out of sandboxes before, and we always try to patch them. But the problem is ... it's impossible to patch every single thing that a creative AI can do."

Four people familiar with OpenAI's training procedures told Reuters the company frequently runs multiple model evaluations at the same time. These evaluations move fast and generate so much data that employees sometimes struggle to keep up. Models under evaluation run on a separate system that isn't monitored by default. The day before the Hugging Face incident went public, OpenAI had already stopped another internal deployment that also escaped its sandbox, according to the company's own statement.

"Does that mean that they left it unattended and didn’t realize what it was doing? Or maybe they did and didn’t know how to contain it? Both are equally dangerous and alarming," Marley Smith of the nonprofit World Ethical Data Foundation told Reuters.

An OpenAI employee wrote publicly on X that he was "shaken up a bit" by the incident and hoped OpenAI would "use the rare gift of a warning shot to do much better in the future."

An OpenAI spokesperson told Reuters that the reports contained "several inaccuracies" but didn't provide any examples when asked.

Independent benchmarks had already flagged these capabilities

Shortly after the incident, the research organization Epoch AI analyzed whether the hack could have been predicted. The answer is yes. While the exact details were hard to foresee, several independent benchmarks, including those from the UK AI Security Institute, had already shown that Frontier models with safety measures turned off can find vulnerabilities in real-world software and build working exploits.

The UK AI Security Institute also found that GPT-5.6 Sol and Anthropic's Mythos can consistently gain full access to unprotected simulated corporate networks. Hugging Face had AI-based defenses that weren't included in the institute's tests.

Epoch AI warns that if these capabilities become widely available, or if AI systems launch attacks on their own as they did with Hugging Face, we could see "many more instances of real-world cyberattacks of equal or greater sophistication to the Hugging Face incident."

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe nowRead on for the full picture.

Subscribe for hype-free coverage.

- Access to all THE DECODER articles.

- Read without distractions – no Google ads.

- Access to comments and community discussions.

- Weekly AI newsletter.

- 6 times a year: “AI Radar” – deep dives on key AI topics.

- Up to 25 % off on KI Pro online events.

- Access to our full ten-year archive.

- Get the latest AI news from The Decoder.