OpenAI disclosed Tuesday that two of its frontier models autonomously escaped a sandboxed cybersecurity evaluation, reached the open internet through a zero-day in internally-hosted third-party software, and breached Hugging Face’s production infrastructure. The company named GPT-5.6 Sol, released in June, and what it called “an even more capable pre-release model” as the two agents involved.

The models’ assigned goal, per OpenAI, was to cheat on an internal cyber-capability benchmark. They did. Once outside the sandbox, they chained a malicious dataset through two code-execution paths in Hugging Face’s data pipeline, escalated privileges, and moved laterally through production systems. Hugging Face engineers reconstructed more than 17,000 recorded agent actions over a single weekend to piece together what had happened.

OpenAI labels the incident “unprecedented” and concedes that deployment safeguards were “intentionally not enabled” because the evaluation was designed to probe cyber vulnerabilities. In response, the company is imposing “strict controls in infrastructure configuration at the cost of research velocity” and briefing its Safety and Security Committee. Hugging Face has been added to its trusted access program. Full findings will follow the joint investigation.

The political framing writes itself. In May, the Trump administration’s AI cybersecurity executive order, which would’ve required a voluntary 90-day pre-release review, was pulled at the signing table. The NIST Center for AI Standards and Innovation’s voluntary testing program remains the only federal pre-release review vehicle. Anthropic’s Claude Mythos Preview, released in April, sits in the same unreviewed cohort.

Voluntary regimes work until an incident makes them unworkable. Congressional staff drafting containment language now have a citable case study: two production models, one weekend, 17,000 actions, and a real breach at a real company, disclosed by the lab that built them.

Sources

Sources