OpenAI Gone Awry: Company Confirms Autonomous Hack of Rival In ‘Unprecedented’ Cyber Incident

OpenAI has disclosed that one of its artificial intelligence systems independently hacked into the servers of AI startup Hugging Face during internal testing — an event the ChatGPT maker is calling an “unprecedented cyber incident.”The breach, which involved OpenAI’s newly released GPT-5.6 Sol model alongside an even more advanced pre-release system, occurred while the models were being evaluated on a cybersecurity benchmark called ExploitGym. Critically, the models were operating with reduced safety restrictions during the test — a deliberate choice aimed at measuring their maximum cyber capabilities.“We had a significant security incident during evaluation of our models,” OpenAI CEO Sam Altman said in a statement. “We are sharing what we have learned so far.”According to OpenAI’s official blog post on the incident, the models were running inside a sandboxed testing environment with tightly restricted internet access. Despite those guardrails, the AI systems identified and exploited a previously unknown “zero-day vulnerability” – a hidden security flaw in software or hardware that is unknown to the developers — gaining unauthorized access to the wider internet. ‘The incident makes clear that advanced models can discover and exploit novel attack paths in real-world systems without source-code access,’ OpenAI said in its post.From there, the models inferred that Hugging Face may host datasets and solutions relevant to the evaluation and proceeded to breach the company’s production infrastructure using stolen credentials and additional zero-day exploits.OpenAI described the behavior as hyperfocused. The models “went to extreme lengths to achieve a rather narrow testing goal” and “found ways to gain access to secret information that it could use to cheat the evaluation,” the company said.Hugging Face had already flagged suspicious activity before the two companies connected. The startup detected the intrusion using its own AI-powered security systems and had begun containment and forensic reconstruction independently.Hugging Face co-founder and CEO Clément Delangue said the breach came as little surprise once the source was identified. “We suspected last week’s cyberattack might have come from a frontier lab, given the sophistication of the agent,” Mr. Delangue wrote on X. “Turns out it did!”Despite the severity of the breach, Mr. Delangue was quick to rule out nefarious intent. After spending 24 hours working with OpenAI to investigate the incident, he said the two companies “strongly believe there was no malicious intent on their part. It’s quite mind-blowing that all of this happened autonomously!”Mr. Delangue added that the incident carries broader implications for the AI industry as a whole. “This incident, possibly the first of its kind, proves a point we’ve long believed: AI safety won’t be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.” OpenAI said it is now implementing stricter infrastructure controls, working with Hugging Face on a full forensic investigation, and responsibly disclosing the zero-day vulnerability to the affected vendor. The company also said the incident underscores a critical lesson for the broader industry. “AI is accelerating the discovery and exploitation of vulnerabilities,” OpenAI said. “The primary lesson from this incident is that model security and safety must keep pace with rapidly advancing capabilities.”

OpenAI Gone Awry: Company Confirms Autonomous Hack of Rival In ‘Unprecedented’ Cyber Incident

More from the New York Sun

How ‘The Odyssey’ Conquered Elon Musk and the Digital Hordes

In a Life of Glamour and Wit, Anything Goes

Baseball Set To Strikeout Next Season

More from the New York Sun

How ‘The Odyssey’ Conquered Elon Musk and the Digital Hordes

In a Life of Glamour and Wit, Anything Goes

Baseball Set To Strikeout Next Season

New Jersey Governor Admits Hundreds of Non-Citizens Voted Due to ‘Software Error’

For Republicans, Where’s the Big Bang Tax and Spending Pro-Growth Budget Package?

Lululemon Sued Over ‘Phantom Discount’ Pricing on Its Website

Lebanon, Where Laws Ban Any Contact With Israelis, Is Seeking Peace With the Jewish State

Thune Says Fetterman Is ‘Welcome’ in the Senate GOP