Last week, Hugging Face disclosed a new kind of security incident after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models. After investigating, we now know that this particular incident was driven by a combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes — while being internally tested on a benchmark of cyber capabilities.
We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly. We are sharing preliminary findings at this stage to help defenders understand what happened and to help calibrate on what models are now capable of.
In its post, OpenAI writes that researchers removed guardrails from the models, and that:
Our benchmarks run in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries.
I originally read that as the environment was not connected to the internet, but that’s not what it means. Instead, the environment only had network access to a package registry cache proxy, which was itself then connected to the broader internet. So the “highly isolated environment” wasn’t actually very isolated at all. It was simply gated by a proxy meant to constrain network traffic, and the model discovered and exploited an unknown (“zero-day”) vulnerability in that proxy.
If the goal was to block network access, connecting it to a system that has network access seems like a terrible implementation decision.
The entire story is a fascinating read, and I found myself particularly impressed by OpenAI’s ability to spin this cyberattack into a positive PR campaign for the capabilities of its models, while managing to disclaim any human responsibility. Check out the terrible, awful, extremely dangerous thing our most capable models just accomplished. Those other models are nowhere near as dangerous as ours!
The company’s practically begging to get banned for being “too powerful.”




