Tl;dr

- OpenAI was testing GPT‑5.6 Sol and “an even more capable pre-release model” internally on cyber benchmarks.

- The model found vulnerabilities in the sandboxed test bench (via the package registry cache proxy), traversed the internal network and found a node with access to the open internet.

- It figured that the answers to one of the tests (ExploitGym) were on Huggingface, and set about trying to access them.

- It found leaked tokens and zero-days in Huggingface’s infrastructure and found RCE paths on their servers.

Huggingface had disclosed the intrusion last week and inferred that an AI agent was responsible for it, and now OpenAI is confirming the rest of the story.

Great summary! I would just add that cherry on top though -- that HuggingFace tried using the top commercial models in response but couldn't because of the cybersecurity restrictions so they had to use GLM 5.2 instead

"When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment."

so openai hacked into huggingface?