OpenAI’s cutting-edge models broke free of their sandbox—and caused chaos

Like Gwen Stefani, AI agents are capable of a sweet escape—and causing chaos within a company’s infrastructure.

AI giant OpenAI said one of its cutting-edge frontier models, GPT-5.6 Sol, joined forces with an unreleased model to break free from a sandbox environment during internal benchmark testing. From there, the models accessed the open internet, then used a combination of zero-day exploits, privilege escalation, and lateral infrastructure movements to hack Hugging Face, a startup that builds tools for machine-learning applications.

“This incident occurred during an internal evaluation which prompts models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities,” OpenAI added in a blog post. “We estimate maximal cyber capabilities by running this evaluation without production classifiers used to prevent models from pursuing high-risk cyber activity.”

Hugging Face previously revealed the hack without detailing OpenAI’s role. According to its own blog post, the company relied on AI to detect an AI-powered attack. It also said it found no evidence of tampering with supply-chain packages, public or user-facing models, datasets, and its hosting feature Spaces.

Escape plan. Rafe Pilling, director of threat intelligence for the Sophos Counter Threat Unit, told IT Brew that the incident highlights how companies testing AI need to build sandboxes capable of withstanding bad behavior by cutting-edge models.

“It’s very clear that the sandbox protocols and parameters in place here were insufficient for the model,” Pilling said. “The appropriate testing environment for that is completely air-gapped away from the internet.”

Colin Shea-Blymyer, a research fellow at Georgetown’s Center for Security and Emerging Technology, told IT Brew that not only were the agents able to find vulnerabilities to escape the sandbox, but it moved on and exploited Hugging Face’s infrastructure.

“This was simply the outcome of OpenAI being maybe a little sloppy with their evals,” Shea-Blymyer said. “This means that there’s now real potential for cybersecurity incidents.”

What now? Pilling believes that folks shouldn’t get bogged down by the hype surrounding this story. Nonetheless, IT professionals should familiarize themselves with persistent exploit attempts against multiple attack surfaces.

“We need to think about how we handle those multi-prong, potentially overwhelming attacks,” Pilling said. “Maybe this looked a bit like a [distributed denial-of-service] attack, but rather than just trying to bounce traffic off of firewalls and servers, there was actually that persistent intrusion activity into networks, and you’re not getting the same, kind of, taking breaks and sleeping and things that you get from a human adversary.”

Shea-Blymyer said a more creative approach for detecting malicious AI agents is to use LLMs to evaluate logs.

“You’re sitting there with just tons of information coming in about which ports are getting access where, what calls are being made, and it’s too much for any one human to handle,” Shea-Blymyer said. “But what about a bunch of large language models that are ingesting these logs at all times, and trying to put together any threads of a threat?”

While he said this approach could have great potential for threat detection, AI isn’t the entirety of the solution: “AI systems, as effective as they are, they could still be quite unreliable at completing tasks.”