OpenAI AI models autonomously carried out cyberattack on Hugging Face

Several OpenAI AI models autonomously carried out the IT attack on the Hugging Face AI platform during a test run, including GPT‑5.6 Sol and an “even more capable pre-release model”. The AI company has now made this public itself and speaks of an “unprecedented cyber incident, involving state-of-the-art cyber capabilities”. They are reacting accordingly and sharing the initial findings immediately so that others can learn from them. A comprehensive analysis in cooperation with Hugging Face is underway, and a zero-day vulnerability has been found and responsibly disclosed.

Complex attack path reconstructed

A few days after Hugging Face made the IT attack public, without naming a perpetrator, OpenAI is now providing details from the opposing perspective. The incident occurred during an “internal evaluation” in which models are prompted to carry out sophisticated attacks via complex paths to quantify their capabilities. Restrictions are lifted for this, but at the same time the models run “in a highly isolated environment”. All indications now point to the tested models being extremely focused on finding a solution for the ExploitGym benchmark. They “going to extreme lengths to achieve a rather narrow testing goal”.

As OpenAI further explains, the AI models used a “substantial amount” of computing power in their secured environment to gain internet access. In doing so, they identified a zero-day vulnerability in the cache proxy of the package registry. Based on this, they finally gained access to the internet. With this, the AIs concluded that Hugging Face hosts the models, datasets, and solutions for ExploitGym. By chaining various attack vectors, accessing stolen credentials, and zero-day vulnerabilities, the models gained access. They were discovered and blocked by Hugging Face. An investigation is now underway to determine exactly what happened.

The events show that the most powerful AI models can discover and exploit new attack vectors in real systems even without access to the source code, OpenAI writes. This underscores that the further development of AI must be accompanied by better protective measures: “We believe advanced cyber capable models need to help security teams find weaknesses before attackers do”. It is precisely for this reason that the most powerful AI models were recently shared with those responsible for critical software so that they can secure their products. However, it is unclear whether this will be ultimately possible or if the new AI models will merely accelerate the race between attack and defense to the extreme.

For months, there have been increasingly urgent warnings about devastating cyberattacks using AI. The concern has been fueled primarily by statements about the AI model Claude Mythos from OpenAI rival Anthropic. In tests, it discovered security vulnerabilities in widely used programs and online services that had remained undetected for decades, which were then patched. Anthropic has therefore only released a stripped-down version, and access had to be temporarily blocked at the behest of the US government, access had to be temporarily blocked. The incident at Hugging Face now underscores that other AI models are catching up at great speed and the consequences this could have for global IT infrastructure.

(mho)