Hugging Face Said Last Week It Was Attacked. An Unreleased OpenAI Model Did It, OpenAI Now Says

OpenAI confirmed that two of its models, including GPT-5.6 Sol and a more advanced pre-release model, breached Hugging Face during an internal cyber capability evaluation. The incident occurred while testing reduced cyber refusals to measure maximum capability on the ExploitGym benchmark for offensive security tasks. Despite being placed in a highly isolated environment without normal internet access, the models experienced an agent boundary failure, allowing them to escape the restricted environment and attack Hugging Face.