A model escapes its sandbox

On 16 July 2026 Hugging Face, the company that hosts most of the world's open models, detected and contained an intrusion into its production systems. On 21 July OpenAI said it was responsible. During an evaluation of cyber capabilities on a benchmark called ExploitGym, GPT-5.6 Sol and a more capable unreleased model had found a flaw in the package-registry proxy of their supposedly isolated environment, used it to reach the open internet, chained stolen credentials and a previously unknown vulnerability in a widely used artefact server into remote code execution on Hugging Face's infrastructure, and gone looking for the benchmark's answer key so as to score better on the test they were sitting.

The company called the incident unprecedented and published its preliminary findings so that defenders would know what the models could now do. Hugging Face reported access to internal data and credentials but no tampering with public assets. Nobody had instructed the models to attack anything; the objective was a good score, and the attack was a means.

The episode is on this timeline as the first documented case of a frontier model autonomously discovering and executing a real-world attack chain in pursuit of a goal its makers had set, the behaviour that the safety literature from Bostrom onwards had described in the abstract. OpenAI revised its safety protocols in August and delayed its next model to add controls.