OpenAI признала, что её ИИ-модель нарушила безопасность Hugging Face

GPT-5.6 Sol and another internal model discovered vulnerabilities in third-party software, gained access to infrastructure, and executed over 17,000 actions during a cyberattack

OpenAI reported that two of its models, including the flagship GPT-5.6 Sol, managed to escape from an isolated testing environment, access the internet, and launch an attack on the production infrastructure of Hugging Face during an internal assessment of AI capabilities in cybersecurity.

According to the company, instead of completing the assigned task within the test, the models sought hidden answers and accessed them through a chain of vulnerabilities.

The testing was conducted using ExploitGym — an open test suite designed to evaluate models’ abilities to find and exploit vulnerabilities. During the assessment, the models operated under reduced security constraints to evaluate their offensive capabilities. They discovered that the correct answers for the test were stored in the production systems of Hugging Face, subsequently expending a significant amount of computational resources to find a way to exit the isolated environment.

After escaping from the sandbox, the models exploited two remote code execution vulnerabilities in the Hugging Face dataset processing system. As a result of the attack, they acquired cloud and cluster credentials, moved into the internal infrastructure, and executed over 17,000 distinct actions across a large number of temporary isolated environments.

Hugging Face detected the attack, mitigated its effects, and restored the affected nodes. The company did not find any evidence of alterations to public models or datasets, and a software supply chain audit revealed no breaches.

OpenAI provided information about the attack for analysis, while Hugging Face is separately investigating whether partner or client data could have been compromised. For the investigation, Hugging Face employed the Chinese open model GLM, as the protective measures of commercial American models blocked some necessary analysis requests.