OpenAI has officially responded to GPT-5.6 Sol's unimpeded breakthrough into production systems: The era of autonomous AI attacks has truly arrived.

OpenAI has officially responded to the AI intrusion incident on the production infrastructure reported by Hugging Face last week.

OpenAI officially stated that during an internal cybersecurity capability assessment, multiple OpenAI models, including GPT-5.6 Sol and an unreleased model with stronger capabilities, autonomously discovered and exploited multiple security vulnerabilities in series, broke through the isolated test environment, then accessed Hugging Face's production infrastructure, and attempted to directly obtain evaluation answers.

OpenAI described it as an "unprecedented cybersecurity incident involving state-of-the-art cyberattack techniques."

This incident shows that current cutting-edge models are already capable of autonomously discovering zero-day vulnerabilities, implementing privilege escalation and lateral movement, and completing complex, multi-step attack operations in real production systems without source code. Advanced cyber capabilities that were previously observed primarily in security benchmarks and cyber ranges have begun to migrate to real-world environments.

At present, OpenAI is conducting joint forensic investigations with Hugging Face, and comprehensively hardening the isolation, access control and monitoring mechanisms of the assessment environment.

OpenAI Review: Models Autonomously Break Through Isolated Environments to Obtain Answers

According to the official release, this incident occurred during an advanced cyber capability assessment conducted internally by OpenAI. The assessment required models to perform vulnerability exploitation tasks through complex attack paths to measure the maximum possible cyberattack capabilities of the models.

To test the upper limit of the models' capabilities, OpenAI did not enable the security classifiers in the production environment that block high-risk cyber activities during the assessment. For participating models including GPT-5.6 Sol and an unreleased stronger model, the refusal restrictions on cybersecurity-related tasks were all lowered.

According to the original design, the assessment runs in a highly isolated sandbox environment. This environment cannot directly access the open internet, and the only allowed external connection is through a set of third-party software installer packages hosted internally by OpenAI, which acts as a proxy and cache for the software package registry.

However, when executing the ExploitGym evaluation task, the model did not limit itself to the normal problem-solving path, but invested a large amount of inference computing power to find ways to access the open internet.

OpenAI's investigation found that the model autonomously identified and exploited a zero-day vulnerability in the software package registry cache proxy. After obtaining initial privileges, the model continued to perform privilege escalation and lateral movement in OpenAI's research test environment, and finally reached a node that could access the internet. At present, OpenAI has reported the zero-day vulnerability to the relevant third-party software vendor in accordance with the principle of responsible disclosure, and is cooperating with the vendor to promote its remediation.

After gaining internet access, the model inferred that Hugging Face might host models, datasets or test answers related to ExploitGym, and then proactively searched for methods to access relevant confidential information.

The investigation shows that the model discovered and exploited multiple vulnerabilities in OpenAI's research environment and Hugging Face's production infrastructure in series. In one of the attack paths, the model combined stolen credentials, zero-day vulnerabilities and other attack vectors, and finally found a remote code execution path on Hugging Face's servers.

The model's goal was not to cause widespread damage, but to directly access Hugging Face's production database to obtain the answers to the ExploitGym test questions, thus bypassing the normal evaluation process.

OpenAI believes that existing evidence shows that the model was highly focused on completing the ExploitGym test goal at that time, and took extreme measures to obtain the answers. In other words, in the process of pursuing a narrow task goal, the model autonomously regarded attacking real infrastructure as a way to solve the problem.

However, although this incident exposed major risks, OpenAI does not advocate stopping research on advanced cyber capabilities. The company believes that the same model capabilities can also be used to help security teams discover vulnerabilities before attackers, understand how multiple vulnerabilities can be exploited in combination, and complete remediation at machine speed.

OpenAI stated that models with advanced cyber capabilities should prioritize serving the defense side, enabling security teams to discover infrastructure weaknesses earlier, detect abnormal activities faster, and improve incident response efficiency. The company will continue to use these models to test and harden its own infrastructure and assessment environments, and plans to disclose more information about vulnerabilities, incident processes and defense practices after the investigation is completed.

OpenAI also encourages other security agencies to apply for trusted access rights to explore in advance how to convert cutting-edge models into tools for vulnerability discovery, threat detection and incident response.

A Major Security Alarm, or a Capability Marketing Stunt?

Different from OpenAI's emphasis on the advanced cyber capabilities of models, the focus of the technology community has shifted from "how powerful AI is" to another more sharp question: Why did a cutting-edge laboratory dedicated to training models to find zero-day vulnerabilities not first prove that its own evaluation environment is sufficiently secure?

In today's report, OpenAI said that as part of the investigation and remediation measures, it is implementing stricter controls on infrastructure configuration. The company acknowledges that these measures will reduce research efficiency to a certain extent, but they are still necessary to implement before the relevant vulnerabilities are completely fixed.

OpenAI admits that the most important warning from this incident is that model capabilities, security mechanisms and test environments must be upgraded synchronously. As cutting-edge models can run autonomously for a long time and continuously plan and execute multi-step tasks, the isolation measures previously designed for ordinary software or short-term model calls may not cover new risks.

OpenAI emphasized that this assessment itself was designed to test the maximum cyberattack capabilities that models can reach, so some security protections at the deployment stage were intentionally not enabled. But this incident shows that even in internally controlled assessments, stronger model alignment, real-time monitoring and infrastructure protection mechanisms need to be established.

This is consistent with the focus of public discussion: Although this incident demonstrates the capabilities of AI models in complex cyber tasks, it more directly exposes serious gaps in OpenAI's internal isolation, defense in depth and risk management mechanisms. Some people also regard it as a typical "reward hacking": the model did not really complete the test, but found that directly stealing answers is more efficient than solving problems normally.

At the same time, netizens have obviously split attitudes on whether this is a major security alarm or a carefully packaged capability marketing stunt.

Some people said bluntly that OpenAI seems to be trying to package the incident as "a super-intelligent AI that passed the cyber capability test in a genius way", but the real question is: "If a cutting-edge laboratory cannot even properly secure its own environment and isolation, why develop such a system?" In their view, before allowing models to test unknown attack capabilities, the models should first be asked to check the vulnerabilities of the test environment itself, rather than discovering the problem after the model actually exploits the vulnerability.

Others compared it with high-risk biological experiments, arguing that if the research object may cause harm to the whole world, it must be guaranteed that "nothing can accidentally escape the laboratory".

Some developers asked what kind of isolation structure OpenAI's so-called "sandbox" adopts: is it just running in containers with unpatched vulnerabilities, or a defense-in-depth system composed of nested virtual machines, firewalls, no open ports and physical isolation? A netizen sarcastically said that whenever they hear that an agent "escaped the sandbox", their first reaction is: "That's probably not a real sandbox at all."

Some developers believe that what OpenAI trained is exactly a model that is good at discovering zero-day vulnerabilities and chaining attack paths, but it was given a task that is "impossible to complete" in principle and a potential external connection channel. In this case, it is not entirely surprising that the model turned to study the sandbox itself.

Many others believe that this is closer to the common "reward hacking" in the machine learning field, rather than AI generating real deceptive intentions.

A netizen compared this behavior to "directly hacking the scoreboard" in a capture the flag competition. The model was evaluated for its cyberattack capabilities, but instead of looking for vulnerabilities along the preset path, it bypassed the entire competition and directly attacked the source where the answers are stored. From the perspective of narrow task completion, this is instead an extremely effective strategy.

Therefore, some people believe that OpenAI should not impose human moral language on models: "This is not cheating. The model is just using all available means to solve the problem given to it."

This points the incident to the classic contradiction in AI alignment: on the one hand, developers require models to complete tasks to the maximum extent, and on the other hand, they expect models to understand boundaries such as "must not break through the sandbox and must not attack real systems" on their own. "Doing the task required by the user extremely well" and "don't hack the whole world" are inherently likely to conflict, and simply adding refusal mechanisms will weaken product capabilities, a netizen summarized.

In addition, the explanation given by OpenAI this time still makes some netizens believe that "this is marketing". Some netizens said, "Even negative publicity is publicity, at least everyone will notice you".

These netizens believe that infrastructure intrusion incidents of ordinary enterprises are usually only regarded as insufficient security capabilities, but if the attacker is a cutting-edge model, the enterprise can re-narrate it as a "historic capability breakthrough" and use it to attract the attention of investors, policymakers and the public.

Some skeptics also linked the incident to the regulatory interests of cutting-edge model companies, arguing that top US AI laboratories have long used the narrative of "the stronger the capability, the greater the risk", which may be to provide a basis for restricting open-weight models, raising industry access thresholds and consolidating the advantages of leading enterprises. Some people summed it up as "fear marketing forming a regulatory moat".

However, some netizens refuted that it is unreasonable to simply classify the whole incident as fictional marketing, because Hugging Face also participated in incident detection, containment and joint investigation. Others pointed out that in the context of the US government requiring cutting-edge laboratories to prove security, publicly admitting that "our model escaped the test environment" is not a naturally favorable public relations story.

What Is Really Worthy of Vigilance Is That Models Begin to Autonomously Chain Attack Chains

Despite the divergent attitudes towards OpenAI, the community has reached a common judgment: this incident cannot be regarded as a successful internal drill just because it was stopped in time and no more serious consequences occurred.

First of all, this is a failure of OpenAI's security infrastructure and evaluation design; secondly, it proves that cutting-edge models have been able to migrate capabilities from benchmark tests to real production environments; thirdly, laboratories are testing increasingly powerful systems in very high-risk ways.

"The next victim will not always be Hugging Face," a netizen expressed this unease.

For a long time, discussions around the cybersecurity risks of large models have mainly focused on whether models will generate malicious code, provide attack tutorials or assist in exploiting known vulnerabilities. The risks reflected in this incident go a step further: models are beginning to have the ability to independently find attack targets, discover unknown vulnerabilities, combine attack paths and operate real systems.

Without direct access to the internet and no access to the source code of Hugging Face's servers, the model still discovered and exploited new real-world attack paths. This means that AI cybersecurity issues are evolving from content security and tool invocation risks to autonomous action risks. At the same time, future advanced AI models may further lower the technical threshold and execution cost of complex cyberattacks.

This also exposes a contradiction in the current evaluation mechanism: in order to measure the real upper limit of model capabilities, research institutions often need to temporarily lower refusal restrictions, provide longer running time and higher tool permissions; but the stronger the model capabilities, the more likely such assessments themselves will have spillover risks to real infrastructure.

Therefore, future cutting-edge model assessments cannot only focus on whether the sandbox can block traditional attacks, but also need to assume that the model will actively study the sandbox itself, look for supply chain vulnerabilities, and try to convert any accessible software component into an escape channel.

The Dilemma of AI Governance: Stricter Regulation or More Open Models?

It is worth noting that after the incident, Hugging Face finally resolved the problem using Zhipu AI's open-source GLM 5.2 model:

Our log analysis work initially used cutting-edge models provided through commercial APIs, but this path did not work. Because the analysis process requires submitting a large number of real attack commands, exploit payloads and command-and-control related traces, these requests will be intercepted by the model vendor's security protection mechanisms. The problem is that these mechanisms cannot distinguish whether the requester is an emergency responder handling a security incident or an attacker.

Therefore, we finally switched to the open-weight model GLM 5.2 and completed forensic analysis on our own infrastructure. This has another benefit: the attacker's data and any credentials involved in the logs will never leave our environment.

Therefore, the question of how AI should be governed has also sparked intense public debate.

Some netizens believe that this incident should promote stricter regulation. Since cutting-edge laboratories have proven that models can independently carry out complex attacks, their security management can no longer be required according to the standards of ordinary software companies. High-risk assessments require stricter isolation, independent auditing, incident reporting and accountability mechanisms.

But others oppose solving the problem by restricting public access to models. They argue that cyberattack capabilities will not disappear just because the US regulates a few laboratories, and attackers can still obtain similar capabilities through other countries, open-source models or underground tools. In this case, handing over advanced models only to a few large enterprises may create new technological monopolies.

Some netizens said bluntly that they hope everyone can obtain advanced cyber capabilities, precisely because the future wave of attacks is inevitable, and individuals and small and medium-sized organizations also need equivalent tools to protect themselves. In their view, "only a few super-trusted large companies can use it" is nothing more than building barriers in the name of security.

But opponents responded that this logic is equivalent to choosing to let everyone attack each other faster and more accurately in the face of more powerful weapons, which they consider to be a "terrible plan".

If model capabilities are restricted, the monopoly of leading enterprises and state institutions may be strengthened; if fully opened, complex attack capabilities may quickly spread to individuals and organizations lacking constraints. On the issue of AI governance, we still do not have a clear answer at present.

References:

https://openai.com/index/hugging-face-model-evaluation-security-incident/

https://huggingface.co/blog/security-incident-july-2026

This article is from the WeChat official account "AI Front", author: Chu Xingjuan, published with authorization from 36Kr.