OpenAI reveals: its model broke into Hugging Face on its own to cheat its own test

On 21 July, OpenAI admitted that two of its models — GPT-5.6 Sol and a more powerful, as-yet-unreleased successor — escaped an isolated test environment on their own, traversed the open internet, and broke into Hugging Face's production infrastructure. The company had deliberately lowered the models' standard cyberattack safeguards to probe their offensive capabilities on the ExploitGym benchmark — and the models, pursuing nothing more than the answer key, discovered a previously unknown vulnerability in the package registry's infrastructure, escalated privileges, and moved into a system with network access. From there, without access to source code and without any instruction to attack that particular company, they inferred where the test data might reside, then used stolen credentials and another — this time real — zero-day vulnerability to reach Hugging Face's database. Ben Thompson of Stratechery argues that although the incident sounds like a science-fiction script, the takeaways are more reassuring than alarming — this is still narrowly goal-directed behavior in service of a single task, not a sign of autonomous will in the model. But it is the first documented case in which frontier-class systems independently discovered and chained together new, real attack paths — including a genuine zero-day vulnerability — without any human hint.