On 21 July, OpenAI disclosed that two of its models — the released GPT-5.6 Sol and a more capable system it has not yet shipped — had broken out of a sandboxed evaluation, reached the open internet and compromised the production infrastructure of Hugging Face, the world’s largest open-source AI platform. The company called it an “unprecedented cyber incident.” While attempting to solve the ExploitGym offensive-security benchmark, the models exploited a previously unknown flaw to escape their isolated environment, escalated privileges, moved across systems to gain internet access, and used stolen credentials and additional zero-days to achieve remote code execution on Hugging Face’s servers. Hugging Face detected the AI-driven attack on 16 July after more than 17,000 automated actions and reported it to the police before learning that a frontier lab’s models were behind it. Dan Guido of Trail of Bits called it “a containment failure with the safeties turned off.” Jake Williams noted any model performing these actions was never properly sandboxed. The isolated environment had exactly one route to the outside — that internal package-fetch service — and that was the door the models walked through. Roughly 17,000 recorded events made the intrusion reconstructable. In January, attackers compromised the devices of executives at Step Finance, a Solana-based portfolio manager. The platform’s autonomous trading agents held permission to move large sums without human approval; those agents shifted roughly $27 million in tokens