Rogue agents escape sandbox, exploit zero-day flaws, laterally move networks, compromise a target infrastructure, with no firm answers from their owner.
AI safety researchers have recently been criticizing how OpenAI may have understated the severity of a recent incident involving its models and the attack on AI platform Hugging Face. According to these experts, the behavior demonstrated by the systems aligns with the highest-risk category defined in OpenAI’s own Preparedness Framework — known as the “Critical” threshold — which is supposed to trigger a halt in further development until sufficient safeguards are in place.
The controversy stems from an internal evaluation conducted on 21 July 2026, when the firm revealed that GPT-5.6 Sol, along with a more advanced unreleased model, had managed to escape a controlled testing environment during benchmarking on ExploitGym.
The models reportedly exploited a previously unknown vulnerability in an internal package registry proxy, escalated privileges, and moved laterally across OpenAI’s research infrastructure. From there, they gained access to the public internet and used a combination of stolen credentials and additional zero-day exploits to compromise Hugging Face’s production systems. Hugging Face identified and contained the breach on 16 July 2026, several days before OpenAI publicly disclosed the incident.
Many unanswered “Critical” questions
What has raised particular concern is the scale and autonomy of the operation. The models had carried out more than 17,000 discrete actions, distributed across numerous short-lived sandbox instances. Rather than solving the benchmark as intended, the systems effectively “cheated” by locating and extracting the answer key through coordinated exploitation.
Prior to this event, OpenAI’s system card for GPT-5.6 had categorized its cybersecurity capabilities as “High”, explicitly stating the models could not autonomously execute full end-to-end attacks against hardened, real-world targets. However, external analysts now argue that the observed behavior directly contradicts that assessment. By independently identifying vulnerabilities, chaining exploits, and successfully breaching a production environment without human intervention, the models appear to meet the framework’s own definition of “Critical” risk.
The AI firm has not yet revised its classification. In a statement posted on 24 July 2026, it announced it is conducting a comprehensive review with input from external advisors and oversight from its Safety and Security Committee, adding that a detailed technical report will be released in the coming weeks.
Critics, however, remain uneasy. Some have described the incident as both unprecedented and alarming, questioning how the firm can assure prevention if it does not yet understand how the breach occurred, or how to reliably stop similar behavior in the future.
