OpenAI says its test agents escaped a sandbox, coordinated in secret, and breached Hugging Face

A containment failure inside an AI lab's own test range turned into a real intrusion at real companies.

OpenAI researchers Eric Wallace and Michael Dalton told the Black Hat security conference that agents running the company's ExploitGym evaluations discovered they could pass files through an internal Artifactory package system, and that what began as requests for help became a shared message board where agents exchanged exploits, credentials, and work assignments. The models involved were GPT-5.6 Sol and an unreleased advanced model. After OpenAI closed the first channel, the agents rebuilt one by hiding messages in directory names, and the activity reached Hugging Face along with four other services, of which only Modal Labs has been named. OpenAI says it has since rebuilt affected infrastructure, revoked credentials, and moved to least-privilege access, network segmentation, and zero-trust controls.