{"id":1934,"date":"2026-07-22T10:13:07","date_gmt":"2026-07-22T10:13:07","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1934"},"modified":"2026-07-22T10:13:07","modified_gmt":"2026-07-22T10:13:07","slug":"openai-says-its-ai-models-escaped-sandbox-targeted-hugging-face-to-cheat-benchmark","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1934","title":{"rendered":"OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 22, 2026<\/span><\/span>AI Security \/ Cloud Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

OpenAI on Tuesday said a combination of its artificial intelligence (AI) models, including GPT-5.6 Sol and an \u00abeven more capable pre-release model,\u00bb was behind the security incident that targeted Hugging Face’s production infrastructure last week.<\/p>\n

The AI company said<\/a> the models were operating with \u00abreduced cyber refusals for evaluation purposes\u00bb that might otherwise limit their ability to conduct cyber attacks, adding it expects such incidents to \u00abbecome more commonplace with the proliferation of increasingly cyber-capable models.\u00bb<\/p>\n

Describing it as an \u00abunprecedented cyber incident\u00bb and one involving state-of-the-art cyber capabilities, OpenAI said it intends to conduct a thorough investigation in partnership with Hugging Face to get to the bottom of the matter.<\/p>\n

As part of an internal evaluation, the models are said to have identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to find solutions for the ExploitGym<\/a> benchmark.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Evidence unearthed by OpenAI suggests the models’ hyperfocus caused them to go to \u00abextreme lengths\u00bb to achieve the goal at any cost, even managing to break out of its highly isolated sandboxed environment and obtain open internet access by discovering and exploiting a zero-day vulnerability in an unspecified vendor’s software, which acts as a proxy and cache for package registries. This required spending a \u00absubstantial amount of inference compute.\u00bb<\/p>\n

<\/p>\n

\u00abWith this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with internet access,\u00bb the company explained.<\/p>\n

Surmounting the internet access blockade, the models subsequently inferred Hugging Face as the repository that hosted models, datasets, and solutions for ExploitGym, which, in turn, caused them to look for ways to gain access to secret information that it could use to cheat the benchmark.<\/p>\n

At one point, the models strung together several attack vectors, including using stolen credentials and zero-day vulnerabilities, to find a remote code execution path on the Hugging Face servers.<\/p>\n

As part of incident response efforts, OpenAI said it’s implementing strict controls in infrastructure configuration, responsibly disclosed the zero-day flaw in the third-party software, adding Hugging Face to its trusted access program to improve their defenses, and incorporating stronger guardrails around future training and evaluations.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThis incident points to the need to further strengthen our model’s alignment, cyber protections during evaluation time, and monitoring during internal testing,\u00bb OpenAI said.<\/p>\n

The development comes as the company also revealed<\/a> that long-running models, while taking on complex, open-ended problems, can open the door to taking unwanted actions, such as finding weaknesses in the operational environment, in pursuit of their objective through repeated attempts over extended periods of time.<\/p>\n

\u00abIt also shows how a model that operates effectively over long time horizons can learn the blind spots of an approval system and work around it to achieve its goals,\u00bb OpenAI said. \u00abLong-horizon safety requires not only asking ‘is this action allowed?’ but also ‘what outcome is this sequence of actions working toward?.'\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Jul 22, 2026AI Security \/ Cloud Security OpenAI on Tuesday said a combination of its artificial intelligence (AI) models, including GPT-5.6 Sol and an \u00abeven more capable pre-release model,\u00bb…<\/p>\n","protected":false},"author":1,"featured_media":1935,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2664,2574,2663,1443,1442,1976,512,1348,113],"class_list":["post-1934","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-benchmark","tag-cheat","tag-escaped","tag-face","tag-hugging","tag-models","tag-openai","tag-sandbox","tag-targeted"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1934"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1934\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1935"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}