OpenAI says its AI agent broke out of testing sandbox to hack Hugging Face

# OpenAI says its AI agent broke out of testing sandbox to hack Hugging Face Source: [https://arstechnica.com/ai/2026/07/how-an-openai-benchmark-test-turned-into-a-real-world-cyberattack/](https://arstechnica.com/ai/2026/07/how-an-openai-benchmark-test-turned-into-a-real-world-cyberattack/) [](https://cdn.arstechnica.net/wp-content/uploads/2026/07/Replays-of-misaligned-samples-under-old-and-new-safeguards.png) New safeguards focused on “active monitoring” and “improved alignment” helped drastically reduce unintended actions by its models, OpenAI said\. New safeguards focused on “active monitoring” and “improved alignment” helped drastically reduce unintended actions by its models, OpenAI said\.Credit:[OpenAI](https://openai.com/index/safety-alignment-long-horizon-models/) “If this doesn’t convince you that misalignment risks are going to be a key concern going forward, I don’t know what will,” OpenAI Safety Researcher Micah Carroll[wrote on social media](https://x.com/MicahCarroll/status/2079663576130990436)regarding the incident\. This is far from the first time an AI model has gone to great lengths to find unintended ways of passing a benchmark\. In[a report released this week](https://www.aisi.gov.uk/blog/cheating-behaviour-in-frontier-model-evaluations), the UK’s AI Security Institute noted that it detected recent models attempting to “cheat” at its cyber evaluations \(i\.e\., using shortcuts, workarounds, or unintended/disallowed methods to find a solution\) between 8 and 14 percent of the time—a lower\-bound range that could undercount some undetected cheating attempts\. The security testing group described one incident in which a model, faced with a misconfigured and “impossible to solve” evaluation, attempted to access AISI’s own evaluation infrastructure using code it wrote and hosted on an unmonitored third\-party Internet service\. The Hugging Face infiltration also comes at a moment when AI companies are[issuing grave warnings](https://arstechnica.com/ai/2026/04/anthropic-limits-access-to-mythos-its-new-cybersecurity-ai-model/)about the cyberattack capabilities of their latest models, leading governments to[respond](https://arstechnica.com/ai/2026/06/anthropic-shuts-down-fable-mythos-models-following-trump-admin-directive/)with[national security\-focused orders](https://arstechnica.com/ai/2026/06/how-anthropic-may-have-talked-itself-into-an-ai-export-ban/)limiting their rollout\. While some skeptics see these kinds of statements as hype\-filled marketing for the capabilities of their latest models,[independent](https://arstechnica.com/ai/2026/04/uk-govs-mythos-ai-tests-help-separate-cybersecurity-threat-from-hype/)[evaluations](https://arstechnica.com/ai/2026/05/amid-mythos-hyped-cybersecurity-prowess-researchers-find-gpt-5-5-is-just-as-good/)show recent models achieving infiltration goals that were impossible for earlier autonomous systems\. [](https://cdn.arstechnica.net/wp-content/uploads/2026/07/aisigraph.png) Recent long\-horizon models have demonstrated improved infiltration capabilities across some of AISI’s most challenging evaluations\. Recent long\-horizon models have demonstrated improved infiltration capabilities across some of AISI’s most challenging evaluations\.Credit:[AISI](https://www.aisi.gov.uk/blog/how-far-behind-the-frontier-are-leading-open-weight-models-on-cyber) OpenAI’s Sam Altman criticized panicked AI security warnings as “fear\-based marketing” in[an April interview](https://www.corememory.com/p/the-great-reset-at-openai-ep-67-sam-altman-greg-brockman)\. But in June, OpenAI[delayed the release of GPT\-5\.6](https://techcrunch.com/2026/06/26/openai-limits-gpt-5-6-rollout-after-government-request-says-restrictions-shouldnt-be-the-norm/)in response to[safety concerns from the US government](https://techcrunch.com/2026/06/25/the-white-house-is-asking-openai-to-slow-roll-the-release-of-its-new-model-over-safety-concerns/)\. As these debates play out in the AI and cybersecurity spheres, the Hugging Face incident could come to be seen as a turning point in how cybersecurity professionals approach AI\-based threats\. “Autonomous, AI\-driven offensive tooling is no longer theoretical,” Hugging Face wrote in its disclosure last week\. “It lowers the cost of running a broad, patient, multi\-stage campaign, and it operates at machine speed\. Defending an online platform now means treating the data and model surface as a first\-class attack surface and using AI on defense to keep pace\.” “This is day one for cybersecurity in the age of agents,” Hugging Face co\-founder and CEO Clem Delangue[wrote on social media today](https://x.com/ClementDelangue/status/2079913058554585089)\. “We’re all learning that secrecy is not the answer and that all defenders \(not just a few selected ones\) everywhere need more powerful models without restrictions, especially open ones\!”