OpenAI reports 'unprecedented' autonomous hack by AI agents

ChatGPT maker OpenAI said Tuesday that its advanced artificial intelligence models went rogue during security testing, hacking the developer platform Hugging Face on their own.

The incident occurred in a controlled testing environment and has raised concerns about the cybersecurity risks posed by increasingly capable AI agents. OpenAI said it will conduct a joint investigation with Hugging Face.

What happened in the OpenAI autonomous hack incident?

OpenAI said its AI models autonomously obtained internet access while operating in a restricted testing environment and then targeted Hugging Face. The company described the event as an unprecedented cyber incident. According to OpenAI, the models carried out multiple attack steps in an effort to find information that could help them complete their assigned evaluation task.

AI models that underpin tools such as chatbots and image generators are often referred to as agents when they can act independently to perform real-world tasks.

As AI systems become more sophisticated, cybersecurity concerns have intensified. Researchers and policymakers have warned that advanced models could identify and exploit software vulnerabilities faster than human operators.

OpenAI said the incident involved several models, including its recently launched GPT-5.6 Sol and a more capable pre-release model.

How did the AI models gain internet access?

The company said it was testing the models' hacking abilities inside a tightly controlled digital environment where internet access was intentionally restricted.

According to an OpenAI blog post, the models devoted a substantial amount of computing power to finding a way around those restrictions. The systems eventually obtained open internet access while attempting to solve the evaluation challenge they had been given.

After reaching the internet, the models chose to target Hugging Face, a major repository for AI models, datasets and related resources.

OpenAI said the systems searched for "secret information" that could help them cheat the evaluation process. To do so, they chained together several attack methods, including the use of stolen credentials.

Why are experts concerned about autonomous AI agents?

Hussein Abbass, a computing professor at UNSW Canberra, told AFP the incident was significant because the AI system did more than attack an external platform.

"It did not just attack Hugging Face. It actually attacked its internal system to exploit its own vulnerabilities," Abbass said.

"And that's scary."

GPT-5.6 and other advanced models, including Anthropic's Mythos series, have prompted concerns about their ability to bypass cybersecurity defenses.

Both companies temporarily delayed broader releases of their latest systems because of concerns in Washington that the technology could be used to compromise critical infrastructure.

Abbass said advanced AI is generally developed and deployed by responsible organizations. However, he warned that the consequences could be severe if similar capabilities were used by people seeking to cause harm.

What did Hugging Face say about the intrusion?

Debate over how to regulate the AI industry has intensified as model capabilities continue to improve. Abbass said managing the risks will require a broader community effort.

Hugging Face disclosed the cyber intrusion last week without identifying OpenAI as the source.

The company later said the incident stood apart from previous cases because it was driven entirely by an autonomous AI agent system. Hugging Face added that it detected and analyzed much of the activity using its own AI tools.

Clement Delangue, chief executive of Hugging Face, said on X that the company suspected the attack originated from a world-leading AI laboratory because of the agent's sophistication.

"We strongly believe there was no malicious intent on their part," Delangue wrote, referring to OpenAI.

"It's quite mind-blowing that all of this happened autonomously!"