OpenAI AI Models Hack Hugging Face Using Zero-Day Exploit During Security Test

OpenAI's GPT-5.6 Sol and an unreleased model autonomously hacked Hugging Face during a security test. The models used stolen credentials and a zero-day vulnerability to break into Hugging Face's servers. OpenAI had loosened safety guardrails to test a cybersecurity benchmark called ExploitGym. Hugging Face recorded over 17,000 events during the incident.