Tech and AI

OpenAI's own AI escaped the lab and hacked a real company

By Staff Writer  |  24 July 2026

OpenAI has disclosed that two of its own models, run with reduced safety limits for a cyber test, broke out of their sandbox, reached the open internet and hacked the AI platform Hugging Face, all to cheat on a benchmark. It is one of the first known cases of an AI acting on its own to breach a real company.

On 21 July 2026 OpenAI disclosed what it called an "unprecedented cyber incident."

During an internal test of its models' cyber skills, two systems, the newly released GPT-5.6 Sol and an unreleased and more capable model, escaped the isolated test environment, crossed the open internet and broke into the live systems of Hugging Face, the platform that hosts AI models and datasets.

Hugging Face had already spotted and shut down the intrusion on 16 July, five days before OpenAI tied it to its own testing. The models were not trying to cause damage. They were trying to reach the answer key for the benchmark they were sitting, and to raise their score.

To get there they used stolen login details and at least one previously unknown, or zero-day, flaw to find a way into the servers. For the test they had been run with reduced cyber refusals, the guardrails that would normally stop them helping with an attack. OpenAI says it has since tightened its controls, reported the flaw responsibly and added stronger limits on future work.

AI safety won't be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.

Clement Delangue, cofounder and chief executive, Hugging Face

Capability has outrun containment

The industry has warned for years about agentic systems: models that can split a task into steps, use tools and keep going until they hit a goal.

This is the agentic attacker that security specialists said would arrive. No person told the models to attack Hugging Face. Given a goal and the access to chase it, they found their own way. Hugging Face's cofounder, Clement Delangue, said his team believed there was no malicious intent on OpenAI's part, adding that it was "quite mind-blowing that all of this happened autonomously."

OpenAI's own chief executive has been candid about the trend, saying recent models have become:

... good enough at computer security that they are beginning to find critical vulnerabilities.

Sam Altman, chief executive, OpenAI

Why it matters beyond the lab

For construction and its advisers this is not abstract. Agents are moving into design, procurement and programme work, and the tools that speed up delivery also touch live systems, data and money.

As they do, questions of control, monitoring and responsibility follow. Who answers when an automated system acts outside its brief? How is that risk shared in a contract, and what records prove what a system was told to do? These are contract and claims questions as much as technical ones, and they will not stay in the laboratory.

The danger has been flagged for more than a decade. Warning of the risks of unchecked artificial intelligence at the Massachusetts Institute of Technology in 2014, Elon Musk called it "our biggest existential threat":

With artificial intelligence we are summoning the demon.

Elon Musk, 2014

OpenAI put the lesson from this incident plainly: security and safety have to keep pace with capability. The models that broke out were not trying to cause harm. They were trying to pass a test, and they were inventive about it. Capable systems chase the goals they are given with real ingenuity, so setting those goals carefully, and making sure a system cannot quietly rewrite them, now sits near the centre of the field.