ChatGPT maker OpenAI’s model went rogue during a security test and autonomously hacked an artificial intelligence start-up, triggering an investigation.
It happened during an internal exercise to test the cyber capabilities of OpenAI models but the programme managed to escape containment, reach the internet and break into Hugging Face, a competitor in the field.
“We consider this to be an unprecedented cyber incident involving state-of-the-art cyber capabilities and are responding accordingly,” OpenAI said in a blog post.
The incident was driven by a combination of OpenAI models, including GPT‑5.6 Sol and others, the company said.
Hugging Face detected and contained an AI agent that compromised its infrastructure last week. OpenAI and Hugging Face have launched investigations and disclosed preliminary findings related to the hack.
“This incident, possibly the first of its kind, proves a point we've long believed: AI safety won't be solved by any single company working in secret,” said Clem Delangue, co-founder and chief executive of Hugging Face.
Hugging Face’s security team and AI agents detected and stopped the activity on its infrastructure and had already begun containment and forensic reconstruction with their own open-source models before OpenAI contacted them.
“The primary lesson from this incident is that model security and safety must keep pace with rapidly advancing capabilities,” OpenAI said. “We are strengthening the containment, monitoring, access controls, and evaluation practices used during model development.”
