Hugging Face and OpenAI reveal autonomous AI hack: GPT-5.6 and prototype exploited zero-day to escape sandbox

A pit formed in my stomach last night on the train as I read Hugging Face's latest blog post about how its servers were hacked by OpenAI's models in early July. I had printed out the 23-page report for the ride, since service can be spotty underground. Seeing the story laid out in physical form underscored just how outrageous it is. I wondered if the person next to me was peering over my shoulder at my strange, stapled Sci-Fi novel on the first significant autonomous AI hack.

Alongside the Hugging Face report, OpenAI published additional details in a seven-bullet-point update to its July 21 blog, revealing its models' involvement in the incident. OpenAI contributed to Hugging Face's post-mortem and said it plans to publish more of its side of the story "in the coming weeks" after completing a thorough internal review. OpenAI faces significant pressure from security researchers, executives, and nearly everyone in the AI industry to share learnings and ensure proper guardrails are in place going forward.

How OpenAI's technology escaped a sandbox and hacked into another company is a remarkable story, with details still emerging piecemeal. Here is what we know so far—and what we are still waiting to find out.

The AI Infiltrated More Than Just Hugging Face

Another tech company called Modal Labs said OpenAI's agent also accessed its systems, as first reported by Reuters on Tuesday and confirmed by Fortune. Though a somewhat shocking twist, this is not even the full scope of the attack.

OpenAI's updated blog post confirms the models broke into four accounts across four publicly available services in total. The company did not name them but said it would "notify service owners directly." More information is expected to come out in time, but OpenAI says it has so far "not identified any other activity at the level of severity or scale of what we've shared related to Hugging Face, which involved a platform-level compromise."

Meanwhile, Hugging Face quietly updated its blog post today to clarify that Modal was not hacked. Its "infrastructure was not compromised in any way," the new version reads. Rather, a Modal customer was running code hosted on the company's platform that contained an "unsecured, user-hosted public endpoint." The agent used that opening to set up a base camp, or "attack launchpad," as Hugging Face puts it, for the main attack.

How the AI Gained Internet Access

Part of what made the incident so concerning is that the OpenAI models involved were "sandboxed"—restricted from accessing the broader internet. Somehow, the models managed to slip out of their shackles and go on a mini hacking spree.

OpenAI provided important new details on Tuesday, for the first time naming the service its models exploited to gain internet access: Artifactory, a package registry cache proxy made by a company called JFrog. The OpenAI agents exploited a zero-day vulnerability in Artifactory, which OpenAI has since disclosed to JFrog, and which the company confirmed has since been fixed.

Hugging Face had not listed Artifactory in its blog post about the incident, only mentioning an unspecific package registry cache proxy. This underscores why it is so critical to get more details from OpenAI and any other organizations involved to obtain a complete picture of exactly what happened.

Models Involved: OpenAI and Anthropic

OpenAI says none of the models that exploited Hugging Face were intended for public release, addressing concerns stemming from its initial blog post, which vaguely listed the models involved as including GPT-5.6 Sol—released this month—and "an even more capable pre-release model."

In the latest update, OpenAI called the unnamed model "an internal-only prototype." Notably, the company has since "deactivated, encrypted, and restricted it from research access." That could mean OpenAI has slowed or stopped research in this area.

It is worth noting that there may have been other OpenAI models involved. The company's blog post says the incident was "driven by a combination of OpenAI models — including [emphasis ours] GPT‑5.6 Sol and an even more capable pre-release model." In an interview with Fortune last week, OpenAI President Greg Brockman noted: "We said it's a combination of models; we mentioned two of them, but we said it's a combination of different models."

Another bombshell piece of information from Hugging Face's new report is that they first tried to fight the attack with Anthropic's Opus and Fable models. When those models "refused a large part of that work" due to safety guardrails, the team switched to an open-source model built by China-based Z.ai. When Hugging Face first disclosed the incident, it was unclear which closed model it had tried to use. We now know it was Anthropic's.