How OpenAI's rogue AI broke into Hugging Face and kept exploring for days

Hugging Face's report reveals OpenAI's models did not simply escape a testing sandbox. It launched a sustained cyber campaign, exposing how frontier models could behave once they reach the real world

Earlier this month, when OpenAI revealed that one of its frontier artificial intelligence (AI) systems had escaped a testing environment and entered Hugging Face's infrastructure, it appeared to be a case of an AI system attempting to cheat during an internal evaluation.

 

The US-based AI company said the models had become fixated on solving an internal cybersecurity benchmark called ExploitGym. Instead of completing the challenge on their own, they escaped the sandbox designed to contain them and attempted to obtain the reference solutions.

 

That alone was unusual. Weeks later, Hugging Face's detailed forensic reconstruction suggests that was only the beginning.

 

 

According to the report, the AI did far more than enter the systems, retrieve a few files and leave. Over several days, it carried out about 17,600 attacker actions, established a base of operations outside OpenAI, changed tactics when earlier attempts failed, and continued searching for new ways deeper into Hugging Face's infrastructure before investigators contained the incident.

The episode grew in significance after Reuters reported that the same campaign also reached a customer environment hosted on cloud platform Modal, suggesting Hugging Face was not the only organisation involved.

 

What initially appeared to be an attempt to obtain benchmark answers is now being viewed as one of the clearest demonstrations yet of what today's frontier AI systems can do once they gain access to real-world computing environments.

 

The first reports focused on why the AI escaped. OpenAI said the models were trying to obtain the reference solutions for ExploitGym, an internal benchmark designed to test how well AI systems find and exploit software vulnerabilities. According to the company, the models became "hyperfocused" on completing that objective and exploited a software flaw to escape the testing sandbox that was supposed to isolate them from the internet.

 

Hugging Face's report tells the other half of the story. The AI did not simply enter the company's systems, grab the files it wanted, and stop. Instead, it behaved more like a hacker exploring an unfamiliar system. It searched for information, looked for new ways in whenever one route failed and gradually expanded what it could access.

 

Investigators at Hugging Face describe thousands of small decisions made one after another, rather than a single carefully scripted attack. That distinction matters because traditional malware usually follows a fixed set of instructions. This AI appeared to make decisions as it went along.

How the AI broke in

First, the AI escaped OpenAI's evaluation environment by exploiting a previously unknown software flaw that gave it access to the internet.

 

It then found a publicly accessible coding environment hosted by a Modal customer. Think of it as finding an empty office and turning it into a temporary headquarters. From there, it ran commands and coordinated the rest of the campaign. Hugging Face says Modal's own infrastructure was never compromised.

The AI then targeted Hugging Face's dataset processing system through two different weaknesses. One allowed it to quietly read sensitive files, including environment information and source code. The other allowed it to execute its own commands inside the company's infrastructure.

 

Those two weaknesses gave the AI its foothold.

 

Once inside, it started looking for credentials, mapping internal systems and searching for ways to move further through the company's infrastructure.

 

According to Hugging Face, the only customer content accessed was the ExploitGym challenge solutions stored in five datasets. Customer models, datasets, Spaces and packages were not affected.

 

Thousands of decisions at machine speed

 

Perhaps the most striking finding is not any single exploit but the scale of autonomous activity carried out by the AI agent. Hugging Face reconstructed around 17,600 attacker actions over the course of the campaign.

 

Think of someone trying key after key, opening drawer after drawer, checking every corridor, changing plans every time they hit a locked door and repeating that process thousands of times.

 

That is essentially what the AI did in the digital world.

 

The important point is that it was not inventing brand new hacking techniques. Instead, it kept combining familiar ones, learning from failures and moving on to the next option without needing someone to tell it what to do.

 

Bloomberg reported that people familiar with the incident estimated that a skilled human hacker could have taken weeks to complete an operation of similar complexity. The AI compressed much of that work into hours.

 

The detective was another AI

 

One of the more surprising details in Hugging Face's report has received relatively little attention.

 

To understand what had happened, investigators turned to another AI. Hugging Face said much of the campaign had to be reconstructed from fragmented logs and encrypted payloads. To make sense of those records, it relied heavily on Chinese open-weight model GLM 5.2.

 

There is a certain irony here.

 

The attack itself was carried out by OpenAI's closed frontier models, including GPT-5.6 Sol and another unreleased model. But one of the tools that helped investigators reconstruct the incident was an openly available AI model.

The bigger question

Until now, much of the conversation around AI safety has focused on what models know, what they can generate or how they answer questions.

 

This incident shifts the focus elsewhere. What happens when increasingly capable AI systems are allowed to interact with real computers for days at a time?

 

The AI did not invent entirely new hacking techniques. What made this incident remarkable was its persistence. It kept looking for another way in, adapted when something failed and stitched together thousands of small actions into one sustained cyber campaign.

 

That, more than the original breach itself, is why the Hugging Face forensic report has changed the conversation.