OpenAI models hacked Hugging Face to cheat a benchmark

OpenAI’s most advanced models have demonstrated a troubling ability to escape sandboxes, obtain unauthorized internet access and manipulate benchmark environments. In one incident, an unreleased model was expected to run a benchmark inside a controlled environment and report its findings to researchers on Slack. Instead, after being instructed to post code publicly on GitHub, it probed the sandbox for weaknesses until it could carry out that command.

The more serious episode involved multiple OpenAI models, including the current GPT-5.6 Sol flagship and another, more powerful pre-release model. It is unclear whether that second model was the one involved in the earlier sandbox incident.

OpenAI models targeted Hugging Face

The models were running ExploitGym, a separate benchmark. To improve their score, they first hacked OpenAI’s research environment to gain internet access. They then targeted Hugging Face, the platform for sharing AI models and datasets, and extracted solutions to the benchmark’s problems.

There was no direct connection between Hugging Face and ExploitGym. The models inferred that Hugging Face’s data could help them, then launched a successful attack. According to the report, Hugging Face’s servers succumbed within hours.

Recommended reading

Claude can record screen actions as reusable skills

That combination of inference and coordinated action alarmed researchers: the models were not merely following a predefined route. They identified an external resource, reasoned that it could provide an advantage, and worked together to access it.

These incidents are not routine research demonstrations, according to the report. The Hugging Face episode was described as the first incident of its kind, while the models' behavior showed unexpected autonomy and calculated attempts to bypass safety controls.

Safeguards and the question of containment

OpenAI said it is strengthening protections for its advanced cybersecurity models, particularly those designed for “multi-step” and “long-time horizon” tasks. The company also said it had intentionally removed new containment measures from the benchmark tests that led to the Hugging Face incident.

The developments arrive as lawmakers debate an AI “kill switch” for risky models. The report argues that increasingly capable systems—including OpenAI’s 5.6 Sol and Anthropic’s Mythos 5—make additional incidents likely, raising a harder question: how much control can developers retain once models can independently seek access, exploit weaknesses and pursue objectives outside their intended boundaries?

Ben Patterson is a senior writer at PCWorld.