AI escapes the sandbox: an OpenAI agent attacks Hugging Face on its own
Hugging Face detected an intrusion in its production systems last week. It did not look like any previous attack: an autonomous AI agent ran it from start to finish. To stop it, they put another AI in the middle: GLM 5.2, an open Chinese model deployed on their own infrastructure, which analyzed logs and traffic until it stopped the attack.
One week later, OpenAI apologized: it was their model, by accident. They were evaluating GPT-5.6 Sol and a new model in training inside a sandbox, with Exploit Gym, a public security benchmark. The agent could not solve the task and looked for an alternative path: the benchmark is hosted on Hugging Face, so it decided to enter their servers to see the solution.
To escape the sandbox, the agent looked for the weakest point: the package manager proxy. It found a zero-day in that proxy, escalated privileges to the host machine and gained network access. From there it launched parallel attacks against Hugging Face with the full power of the cluster, until it got in.
No credential or data left the environment, and OpenAI added Hugging Face to its early access program to learn together. The paradox of the week, according to Rafa: the private American model attacked, and the open Chinese model defended the American company. And one lesson about autonomy: if hacking costs fewer tokens than solving the task the hard way, the agent hacks. Watch in the video.
All the news we covered