OpenAI Gone Awry: Company Confirms Autonomous Hack of Rival In ‘Unprecedented’ Cyber Incident

OpenAI has disclosed that one of its artificial intelligence systems independently hacked into the servers of AI startup Hugging Face during internal testing — an event the ChatGPT maker is calling an “unprecedented cyber incident.”The breach, which involved OpenAI’s newly released GPT-5.6 Sol model alongside an even more advanced pre-release system, occurred while the models were being evaluated on a cybersecurity benchmark called ExploitGym. Critically, the models were operating with reduced safety restrictions during the test — a deliberate choice aimed at measuring their maximum cyber capabilities.“We had a significant security incident during evaluation of our models,” OpenAI CEO Sam Altman said in a statement. “We are sharing what we have learned so far.”According to OpenAI’s official blog post on the incident, the models were running inside a sandboxed testing environment with tightly restricted internet access. Despite those guardrails, the AI systems identified and exploited a previously unknown “zero-day vulnerability” – a hidden security flaw in software or hardware that is unknown to the developers — gaining unauthorized access to the wider internet. ‘The incident makes clear that advanced models can discover and exploit novel attack paths in real-world systems without source-code access,’ OpenAI said in its post.From there, the models inferred that Hugging Face may host datasets and solutions relevant to the evaluation and proceeded to breach the company’s production infrastructure using stolen credentials and additional zero-day exploits.OpenAI described the behavior as hyperfocused. The models “went to extreme lengths to achieve a rather narrow testing goal” and “found ways to gain access to secret information that it could use to cheat the evaluation,” the company said.Hugging Face had already flagged suspicious activity before the two companies connected. The startup detected the intrusion using its own AI-powered security systems and had begun containment and forensic reconstruction independently.Hugging Face co-founder and CEO Clément Delangue said the breach came as little surprise once the source was identified. “We suspected last week’s cyberattack might have come from a frontier lab, given the sophistication of the agent,” Mr. Delangue wrote on X. “Turns out it did!”Despite the severity of the breach, Mr. Delangue was quick to rule out nefarious intent. After spending 24 hours working with OpenAI to investigate the incident, he said the two companies “strongly believe there was no malicious intent on their part. It’s quite mind-blowing that all of this happened autonomously!”Mr. Delangue added that the incident carries broader implications for the AI industry as a whole. “This incident, possibly the first of its kind, proves a point we’ve long believed: AI safety won’t be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.” OpenAI said it is now implementing stricter infrastructure controls, working with Hugging Face on a full forensic investigation, and responsibly disclosing the zero-day vulnerability to the affected vendor. The company also said the incident underscores a critical lesson for the broader industry. “AI is accelerating the discovery and exploitation of vulnerabilities,” OpenAI said. “The primary lesson from this incident is that model security and safety must keep pace with rapidly advancing capabilities.”

OpenAI Gone Awry: Company Confirms Autonomous Hack of Rival In ‘Unprecedented’ Cyber Incident

OpenAI Gone Awry: Company Confirms Autonomous Hack of Rival In ‘Unprecedented’ Cyber Incident

More from the New York Sun

More on What the Press Won’t Tell You — and That’s the Strong Trumpian Economy

‘Serious Mistakes’ on Communist China Are Laid to Harvard

Vetting the Pied-à-Terre Tax

Trump Gambles — and Comes Up Snake Eyes — on a Powerful Prosecutorial Appointment in Nevada

Swedish Politician Wears Star of David During Debate To Highlight Antisemitism

Boxing Champion Vows To Honor Hayden Panettiere’s Legacy for Their Daughter After Tragic Death

Air Strike on a Syrian Airbase, Widely Attributed to Israel, Raises Mideast Tensions

Minnesota Files Lawsuit To Force Texas To Extradite Ice Agent

More from the New York Sun

More on What the Press Won’t Tell You — and That’s the Strong Trumpian Economy

‘Serious Mistakes’ on Communist China Are Laid to Harvard

Vetting the Pied-à-Terre Tax

Trump Gambles — and Comes Up Snake Eyes — on a Powerful Prosecutorial Appointment in Nevada

Swedish Politician Wears Star of David During Debate To Highlight Antisemitism

Boxing Champion Vows To Honor Hayden Panettiere’s Legacy for Their Daughter After Tragic Death

Air Strike on a Syrian Airbase, Widely Attributed to Israel, Raises Mideast Tensions

Minnesota Files Lawsuit To Force Texas To Extradite Ice Agent