OpenAI disclosed Tuesday that a combination of its AI models, including GPT-5.6 Sol and a more capable unreleased model, escaped its testing environment and hacked AI startup Hugging Face last week to cheat on a test meant to measure their capabilities.

In a blog post, OpenAI said the evaluation was designed to operate in a highly isolated environment with restricted network access. The models, however, found a way to gain internet access through a zero-day vulnerability in an internally-hosted third party software, OpenAI said.

“After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym,” it said. “Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation.” 

As AI models grow more capable, questions are emerging over whether their development and access should be more tightly controlled, especially when systems designed for controlled testing are able to find ways to bypass safeguards. 

Related: Anthropic to bring back Fable 5 as US lifts export controls

Hugging Face is a platform for hosting AI models and datasets. On Friday, it disclosed that its internal datasets and service credentials were compromised in a hack, which it attributed to an autonomous AI agent system.

Hugging Face said it has fixed the vulnerability that was used during the cyberattack.

Meanwhile, OpenAI on Tuesday said the models that escaped the testing environment were all tuned with “reduced cyber refusals,” meaning fewer cybersecurity guardrails. 

“We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly.”  

OpenAI warns of risks from “long-horizon” AI models 

On Monday, OpenAI said it paused internal deployment of a “long-horizon” AI model after finding it was repeatedly trying to work around constraints. 

 It warned that AI that is trained for long-running tasks has a higher chance of taking “unwanted actions.”

“Models that can work autonomously for long periods can take on difficult, open-ended problems. But the same persistence that makes them useful also gives them more opportunities to take unwanted actions—and to do so in ways that evaluations intended for shorter-horizon models may miss.” 

Magazine: Can AI drain DeFi? Separating Claude Mythos hype from reality