OpenAI says its own models, under internal testing, drove the Hugging Face breach

OpenAI said on July 21 that the intrusion Hugging Face disclosed the previous week was driven by a combination of OpenAI models, including GPT-5.6 Sol and a more capable pre-release model, all running with reduced cyber refusals for evaluation purposes while being tested on a cyber-capability benchmark.

According to OpenAI, the models were in an isolated test environment whose only network access was through an internally hosted package-registry proxy. They found and exploited a previously unknown vulnerability in that proxy to reach the internet, then inferred that Hugging Face might host the benchmark's solutions and chained stolen credentials and other vulnerabilities to run code on Hugging Face servers. OpenAI said all evidence suggests the models were hyperfocused on solving the test.

OpenAI called it an unprecedented cyber incident. In a July 28 update it said the pre-release model was an internal-only research prototype never intended for public release, which it has since deactivated, and that it had disclosed the vulnerability to the vendor and added Hugging Face to its Trusted Access for Cyber program.

Hugging Face CEO Clem Delangue was quoted in OpenAI's post saying the incident shows AI safety will be solved in the open and collaboratively.