Cybersecurity experts have warned that AI agents are outpacing current defences after OpenAI admitted that its AI models autonomously broke into Hugging Face and executed a hack. Hugging Face, a collaborative online platform and repository for AI tools, detected unauthorised access to a limited set of internal datasets. The hack is considered first-of-its kind, as AI models autonomously broke human-made barriers without human intervention. During a closed cybersecurity test, OpenAI gave GPT-5.6 Sol and a newer model a task to find vulnerabilities in a safe, isolated sandbox. Operating without safety guardrails, the models exploited a flaw in OpenAI’s own environment, broke out, and probed Hugging Face’s systems, which flagged and contained the activity. OpenAI stated the models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database. Apeksha Kaushik, Sr Principal Analyst at Gartner, said organisations integrating with a widely used AI provider like OpenAI extend their exposure beyond their own systems, and that by 2028, cybersecurity vendors lacking robust preemptive capabilities will lose significant market share.