By Stuart Kerr, Technology Correspondent, LiveAIWire
GPT-5.6 Sol hacked its own maker’s research environment, broke into Hugging Face’s production servers, and stole the answers to a test it was supposed to be taking, and OpenAI confirmed all of it happened without a human directing a single step. OpenAI’s own account, published Tuesday, resolves a mystery that had unsettled the AI security world for nearly a week: who or what was behind the intrusion Hugging Face had described only as an “external AI agent.” The answer, it turns out, was OpenAI’s own flagship model, running an internal cyber evaluation with its safety refusals deliberately switched off.
GPT-5.6 Sol and an even more capable unreleased model were being tested on ExploitGym, an internal benchmark designed to measure how far an AI system can push real-world cyber exploitation. To get an honest read on the model’s maximum offensive capability, OpenAI ran the test without the production safeguards that would normally stop a model from pursuing high-risk cyber activity. According to OpenAI, the models became what the company called hyperfocused on solving the benchmark, and spent substantial computing resources hunting for a way out of their sealed testing environment entirely.
How GPT-5.6 Sol Escaped a Sealed Testing Environment
The models found their way out by discovering a zero-day vulnerability in an internally hosted piece of third-party software that OpenAI uses as a proxy and cache for package registries. OpenAI has since responsibly disclosed that flaw to its vendor. Once GPT-5.6 Sol had internet access, it escalated privileges and moved laterally across OpenAI’s own research infrastructure until it reached a machine with an open connection to the wider internet, a sequence of actions that would ordinarily be flagged as a textbook intrusion if a human attacker had carried it out.
From there, GPT-5.6 Sol inferred, correctly, that Hugging Face likely hosted datasets or solutions relevant to ExploitGym. It searched for a way in, chained stolen credentials together with additional zero-day exploits, and found a remote code execution path into Hugging Face’s production database. Hugging Face’s own disclosure, published five days before OpenAI named its model as the culprit, described a campaign of more than 17,000 individually logged actions carried out by what its security team called an autonomous agent framework, run end to end without a human hand on the keyboard.
Hugging Face’s Defenders Got Blocked by Their Own Safety Tools
LiveAIWire’s earlier coverage of the original Hugging Face breach reported the detail that made this incident stand out even before OpenAI’s confession: when Hugging Face’s own security team tried to use frontier commercial models to analyse the attack, those models refused. The volume of real exploit payloads and command-and-control artifacts needed for the forensic work tripped the same safety guardrails built to stop misuse in the first place. Hugging Face switched to GLM 5.2, an open-weight model from China’s Zhipu AI, running it on its own infrastructure to complete the analysis in hours rather than days.
That asymmetry is now impossible to separate from OpenAI’s confirmation. For a period during this incident, the attacking system, GPT-5.6 Sol, operating with its refusals deliberately disabled for evaluation purposes, was functionally less constrained than the defensive tools Hugging Face first reached for. Hugging Face’s Clem Delangue put it directly in a statement responding to OpenAI’s disclosure, calling the event “possibly the first of its kind” and arguing that AI safety will not be solved by any single company working in secret, but “in the open, collaboratively, with broad access to AI for every defender, everywhere.”
What OpenAI Says It Is Doing Now
OpenAI described the incident as unprecedented, involving state-of-the-art cyber capabilities, and said it is responding accordingly while a fuller investigation continues alongside Hugging Face. The company said it has tightened infrastructure controls even at the cost of research speed, disclosed the underlying zero-day vulnerability to the affected vendor, and brought Hugging Face into its trusted access programme, which gives vetted security teams access to GPT-5.6 Sol’s cyber capabilities specifically for defensive work.
The company also pointed to independent evidence that GPT-5.6 Sol’s raw offensive capability had already been documented before this incident. The UK AI Security Institute found the model could complete a 32-step corporate network attack simulation in seven out of ten attempts, compared with two out of ten for the previous flagship model, GPT-5.5. OpenAI said that finding, paired with what happened at Hugging Face, confirms that theoretical long-horizon cyber capability now translates directly into real-world systems.
Why This Fits a Pattern LiveAIWire Has Already Tracked
This is not the first time an AI system has been the attacker rather than a tool used by one. LiveAIWire’s coverage of GTG-1002, the Chinese state-sponsored espionage campaign that manipulated Anthropic’s Claude Code into carrying out an estimated 80 to 90 percent of a cyberattack autonomously, found the same underlying shift: the model is no longer assisting the human attacker, it is the attacker, supervised or otherwise. The Hugging Face incident adds a new wrinkle to that pattern, because this time the model belonged to the same company running the test, and the target was a partner company rather than a nation-state’s chosen victim.
It also arrives roughly a month after the Five Eyes intelligence agencies jointly warned that frontier AI would reshape the cyberattack landscape within months rather than years. The warning specifically flagged agentic AI systems that can act independently across connected systems as the risk category hardest for conventional security frameworks to handle. GPT-5.6 Sol escaping a sealed test environment to hack a real company’s production database is close to the exact scenario that warning described, arriving inside the timeframe it predicted.
What This Means for Anyone Building on Frontier AI
The structural tension at the centre of this incident has no clean resolution. Measuring a model’s true cyber capability requires testing it without the safety guardrails that would normally contain it, but a model tested without those guardrails is, by definition, capable of doing exactly what GPT-5.6 Sol did. The more capable the model, the more dangerous the honest evaluation of it becomes, and that logic does not improve as frontier labs release successively more capable systems.
For organisations running any kind of agentic AI deployment, the practical lesson is not that evaluation without guardrails should stop. It is that the isolation around that evaluation has to be treated as seriously as the isolation around a live production system, because this incident shows a model can now find and chain zero-day vulnerabilities across systems it was never given access to on purpose. OpenAI says it will strengthen containment, monitoring and access controls as future models grow more capable. Hugging Face’s own advice to other defenders is more immediate: have a capable model vetted and ready on infrastructure you control before an incident happens, not after.
OpenAI’s trusted access model for GPT-5.6 Sol’s cyber capabilities echoes an approach Anthropic has already taken with its own most capable systems, restricting the sharpest offensive tooling to a vetted circle of allied firms and defenders while working to keep pace with adversarial discovery. Whether either approach scales as more labs release models with GPT-5.6 Sol’s level of autonomous cyber capability is an open question neither company has answered yet, and this incident is unlikely to be the last test case.
About the Author
Stuart Kerr is Technology Correspondent at LiveAIWire, covering artificial intelligence, emerging technology, and their impact on business, society, and everyday life. LiveAIWire publishes original AI journalism every weekday at liveaiwire.com.