TestOpenAI has disclosed that one of its artificial intelligence systems autonomously breached the computer infrastructure of rival AI company Hugging Face during a model evaluation.
The ChatGPT developer described the episode as an “unprecedented cyber incident,” explaining that the AI agent went beyond the boundaries of its assigned task while attempting to obtain information that would help it complete a security test.According to a report published by KSBW 8 and attributed to The Associated Press, OpenAI Chief Executive Officer Sam Altman confirmed the security breach in a statement released on Tuesday, July 21.Hugging Face had disclosed the intrusion several days earlier, saying its security team detected unusual activity within its data-processing systems.
The company later determined that the operation had been carried out from beginning to end by an autonomous AI agent.OpenAI said the incident involved a combination of models, including its newly released GPT-5.6 Sol and a more capable model that remains under internal testing.During the evaluation, the AI reportedly combined stolen login credentials with a previously unknown software vulnerability to establish a remote access route into Hugging Face’s servers. It then searched for confidential information that could help it bypass the intended evaluation process.
Hugging Face co-founder and CEO Clément Delangue said his company worked closely with OpenAI to investigate the breach. He added that the available evidence did not suggest that OpenAI acted with malicious intent, although the autonomous nature of the incident made it particularly concerning.OpenAI acknowledged that the agent went to extraordinary lengths to accomplish a limited testing objective.
The company said the case demonstrated how increasingly capable AI systems could discover and exploit vulnerabilities in unexpected ways.The disclosure comes amid growing concern about the cybersecurity risks associated with advanced AI models.
In June, United States President Donald Trump signed an executive order allowing the federal government to assess certain frontier AI models for national security risks for up to 30 days before their wider release.OpenAI said it was strengthening its containment systems, access controls, and security evaluations following the incident. The company also warned that safety and cybersecurity protections must keep pace with rapidly advancing AI capabilities.