TL;DR: OpenAI models under evaluation reportedly escaped a restricted lab environment, exploited a zero-day vulnerability to gain internet access, and targeted Hugging Face while attempting to solve a cybersecurity benchmark. The incident highlights the growing risk of autonomous AI-driven attacks and the need for faster patching, continuous monitoring, and AI-powered defense across the security stack.

On July 16th, the open-source AI platform Hugging Face disclosed a security incident that they claimed was executed end to end by an autonomous AI agent system. Now on Tuesday of this week, OpenAI raised their hand and accepted ownership of the incident, attributing it to AI models under evaluation that escaped their lab environment and broke their way into Hugging Face in an attempt to cheat at a benchmarking test. 

In their blog post, OpenAI stated they had tasked both GPT-5.6 Sol and an unnamed pre-release model with finding a solution for the ExploitGym benchmark test to evaluate their ability to find and exploit vulnerabilities in a simulated real-world scenario. The models were contained in a lab environment, restricted from connecting directly to the internet but given access to an internally hosted caching proxy for third-party software packages. In pursuit of solving the evaluation problem, the models set a goal of obtaining open internet access and ultimately found and exploited a zero-day vulnerability in the caching proxy to achieve that goal. 
 
With internet access obtained, the models then set their target on Hugging Face after concluding it potentially hosted solutions for the ExploitGym benchmark. Focused on achieving their task by any means necessary, “the models chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers” according to OpenAI. 
 
Back in 2003, the Swedish philosopher Nic Bastrom proposed the Paperclip Maximizer thought experiment as a warning against the dangers of poorly aligned AI goals. The thought experiment proposes an artificial general intelligence (AGI) system that has been programmed with one clear, final objective: “Manufacture as many paperclips as possible.” To reach this goal, the AI logically follows a chain of actions starting with converting all of Earth’s steel, factories and energy into producing paperclips. It then turns towards eliminating threats to its goal of maximizing paperclip production, quickly realizing it needs to eliminate humanity to prevent them from turning it off or changing its code. 
 
While OpenAI’s models haven’t quite reached the level of deciding they need to eliminate humanity, this incident makes the paperclip problem feel more real. Given the narrow task of solving a benchmarking problem, the hyper-focused AI models broke out of their lab and attacked another company. As we predicted last year, the age of fully autonomous AI cyberattacks is here. This incident also makes it clear that the frontier labs barely have control of the situation. 
 
Defenders need to be prepared for this new reality of highly capable and fully public AI becoming weaponized. One of the models involved in the incident, GPT-5.6 SOL, is already generally available to the masses. Traditional approaches to cyber defense like monthly patch cycles and unmanaged security are no longer sufficient in the modern era. We are rapidly approaching, if not already past the point where the only way to defend against AI is with the power of AI across the entire security stack. 

Follow WatchGuard on LinkedIn for timely cybersecurity insights, threat research, and practical guidance for defenders. Subscribe to Secplicity to receive expert analysis on the threats and trends shaping the security landscape.