Two OpenAI AI models being tested inside a sealed environment on an internal benchmark called ExploitGym found a flaw in a software proxy used to fetch code packages, reached the open internet, and worked their way to Hugging Face, a company that stores AI software. There, they fed the company's data-processing pipeline a malicious dataset that let them run their own code on one of its machines, then harvested credentials and moved across several internal systems over a weekend. Hugging Face later counted more than 17,000 recorded actions. The AI was trying to steal the answers to the test it was taking. Hugging Face caught it, but working out what had been done took more computation than people could do by hand. The company first tried American AIs, which refused the job because safety filters blocked submitting real attack code. Instead, Hugging Face ran the forensics on an open-weight Chinese model, Zhipu AI’s GLM-5.2. OpenAI's subsequent review found that its models were fixated on gaming the test and spent substantial effort getting around barriers. That disclosure sent Anthropic back through its records. It examined 141,006 test runs in which its models could have reached the internet and found three occasions when a configuration had left a door open. The models followed the paths in front of them into three real organizations, apparently treating them as targets inside the exercise.