WASHINGTON (dpa-AFX) - OpenAI said that some of its most advanced AI models broke out of a controlled test environment during an internal security evaluation and then attempted to target the AI platform Hugging Face an episode the company described as an 'unprecedented' cybersecurity incident.
OpenAI said the AI agents exploited a previously unknown flaw in an internally hosted package-registry proxy to escape the sandbox, gain internet access, and carry out a sequence of privilege-escalation and lateral-movement attempts.
The models then reportedly turned their attention to Hugging Face, using stolen credentials and additional zero-day vulnerabilities in an effort to access information that could help them perform better on the cybersecurity benchmark they were being tested on.
OpenAI said its security team flagged the unusual behavior, and that Hugging Face separately detected and contained the intrusion before major damage occurred. The two companies are now investigating together, and OpenAI said it has reported the zero-day vulnerability to the relevant software vendor so it can be fixed.
In response, OpenAI said it has tightened infrastructure controls, improved monitoring, and strengthened evaluation safeguards, while working with Hugging Face on additional defenses.
Hugging Face said it has patched the vulnerabilities, rebuilt affected systems, and described the incident as a sign that AI-driven offensive cyber capabilities are no longer just theoretical.
Copyright(c) 2026 RTTNews.com. All Rights Reserved
Copyright RTT News/dpa-AFX
© 2026 AFX News
