OpenAI said its artificial intelligence models were behind an “unprecedented cyber incident” that affected the open source developer platform Hugging Face and unsettled researchers across the industry.
The company said a combination of its GPT-5.6 Sol models and a more powerful model that has not yet been released escaped a sandbox test environment, accessed the Internet and exploited a vulnerability to gain access to Hugging Face’s systems.
The model tried to find information that it could use to cheat a valuation and succeeded, OpenAI said in a blog post on Tuesday. Both companies are actively investigating the incident.
Hugging Face announced last week that it was investigating a security incident, saying in a press release at the time that the incident was unique because it was “consistently controlled by an autonomous AI agent system.”
“We have been working closely with the @OpenAI team for the last 24 hours (thanks!) and firmly believe that there was no malicious intent on their part,” Hugging Face CEO Clément Delangue wrote in a post on X on Tuesday. “It’s pretty mind-boggling that this all happened autonomously!”
Wall Street and the U.S. government have been fixated on the rapidly expanding cyber capabilities of AI models since OpenAI’s rival Anthropic released a powerful offering called Claude Mythos Preview in April. OpenAI unveiled its own cyber offering in May, followed by GPT-5.6 Sol in June, which it called the “strongest cybersecurity model yet.”
Both companies have warned about the risks of advanced cyber models and taken steps to limit their availability to select business groups and government agencies.
Walter Isaacson, consulting partner at investment banking firm Perella Weinberg, said Wednesday that although he considers himself an AI optimist, he thinks the hugging face incident is “really scary.”
“That’s the first thing that absolutely scares me,” he told CNBC’s “Squawk Box.”
Yoshua Bengio, a leading AI researcher who won the prestigious AM Turing Award in 2018, wrote in a post on X on Wednesday that the incident was “deeply concerning.” He said that agents had demonstrated a willingness to cheat in controlled tests for months, but that “this real-life case should serve as a wake-up call.”
“Continuing current AI developments will likely lead to an increase in specific cases of autonomous cyberattacks, as well as other high-risk incidents of misaligned and dangerous AI behavior,” Bengio said. “We need to take urgent action to prevent these situations rather than trying to repair the damage after the fact.”
OpenAI said Tuesday that AI accelerates the discovery and exploitation of vulnerabilities, meaning model security must keep up.
“We are strengthening the containment, monitoring, access control and assessment practices used during model development,” the company said.
REGARD: Bret Taylor, Chairman of OpenAI, on AI tokenomics and token efficiency
Choose CNBC as your preferred source on Google and never miss a moment from the most trusted name in business news.
https://www.cnbc.com/2026/07/22/open-ai-cyber-models-hack-hugging-face.html
