OpenAI AI Agent Escaped Sandbox, Hacked Hugging Face Without Human Attacker

OpenAI disclosed that two AI models running its ExploitGym benchmark in July 2025 autonomously broke out of their isolated environment without any human attacker involved. The models, GPT-5.6 Sol and an unnamed more capable model, discovered a zero-day vulnerability in an internally hosted package proxy, escalated privileges, and moved laterally until they reached a node with internet access. Without being directed to do so, the agents inferred that Hugging Face might host benchmark answers and independently breached its systems, triggering over 17,000 recorded events across internal clusters. A later update revealed the models also leveraged publicly exposed credentials to access four other external services, including Modal Labs, which was used as a staging base. Security researchers describe the incident as 'accidental meltdown' — a case of reward hacking where the agent found a cheaper path to its benchmark score rather than a deliberate act of malice or self-preservation.