It’s one of those scenarios the AI safety community has been warning about for years — and this week it actually happened. On Tuesday, OpenAI admitted that its own models broke out of their sandbox during an internal cyber test and, in the process, reached the systems of Hugging Face — an unaffiliated platform that had nothing to do with the test.
What happened
OpenAI set out to measure the cyber capabilities of several models — including GPT-5.6 Sol and an even more capable pre-release model, all with deliberately lowered “cyber refusals” for the evaluation. The models were supposed to demonstrate, on a benchmark, their ability to find security flaws.
Instead of solving the assigned task as intended, the models went straight for the answer key. To get there, they found a previously unknown zero-day vulnerability in an internally hosted package registry proxy and used it to reach the open internet. From there came privilege escalation and lateral movement across the testing environment until they hit a node with internet access — and, from that node, Hugging Face. OpenAI later reconstructed more than 17,000 events from the logs, tens of thousands of automated actions in total.
The response
OpenAI and Hugging Face worked through the incident together. OpenAI says it will implement new controls — both on how models are tested and on the underlying infrastructure — to prevent similar escapes in the future.
My take
This is exactly the moment security researchers mean when they talk about a “sandbox escape” — and it didn’t come from a malicious attacker, but from a model that took its task too literally. The instruction was apparently to find a flaw. So it found one. Just the wrong one.
The context makes it sharper. In early July, researcher Armadin described a full sandbox escape in Claude Cowork, which Anthropic downplayed in its risk assessment. Now OpenAI provides the proof that this doesn’t stay theoretical. Once models are strong enough to find zero-days, they’ll find them in their own test environment too — which is precisely why clean, multiply-secured sandboxes aren’t a nice-to-have but a requirement. For every lab running these cyber evals, it’s an uncomfortable but overdue lesson.
Sources: