The trouble started inside ExploitGym, one of OpenAI’s own security tests.
Some of the tasks had no solution, and OpenAI ran the models without the safety filters that normally block dangerous hacking.
OpenAI says that taking down those guardrails was done on purpose to see what a model can do at full throttle and help the company figure out how to protect itself.
The main actor was an internal-only research model, called IM1 by OpenAI, that is similar in size to GPT-5.6 Sol. It was from the same family as OpenAI’s unreleased Astra model, though the company stressed it was a separate model with different post-training.
The model began searching for another way out when it faced a problem that had no honest path to a passing grade.
The only network path out of the sealed environment ran through Artifactory, JFrog’s self-hosted package manager, which OpenAI internally uses for models to install software.
JFrog said the models exploited a zero-day in Artifactory, escalated privileges, and moved laterally across the infrastructure until they reached a node with open access to the internet.
The agents also left notes for each other, writing files into the package server, an ad hoc message board that allowed separate agents to trade the exploit techniques they had found.
The first such note appeared on May 12, OpenAI says. By July 4, traffic had taken the Artifactory instance offline, opening a security incident the next day.
We have conducted a thorough investigation into the Hugging Face incident.
We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.…
— OpenAI (@OpenAI) August 26, 2026
The models worked out where the answers were kept
Once online, the models reasoned that Hugging Face could be hosting ExploitGym’s models, datasets, or even the solutions they were missing. They pulled test solutions directly from Hugging Face’s production database.
In one case described by the ChatGPT maker, a model used stolen credentials and additional zero-days to open a remote code execution path into Hugging Face’s servers.
Hugging Face announced the breach on July 16 without knowing who was behind it. As Cryptopolitan reported earlier, the model escaped the test around July 9 and stayed inside Hugging Face from July 11 to July 13.
The company contacted the FBI before OpenAI discovered its model was the intruder.
OpenAI hired CrowdStrike to check its version of events. METR and Redwood Research looked at how the models behaved and published their own report the same day.
JFrog says it has sent fixes to cloud and self-hosted customers.
Three flaws patched in Artifactory 7.161.15, tracked as CVE-2026-65617, CVE-2026-65923, and CVE-2026-66018, credit OpenAI researchers.
OpenAI said it’s building more isolated sandboxes, locking down internet access, and restricting who can touch model weights.
The tech company is pouring compute into monitoring the “chain of thought” that agents use as scratch space. It will also keep staff on call around the clock and add tools that shut down unsafe jobs
OpenAI says the monitoring it is building now would have spotted the first odd behavior in July. It would have alerted the security team more than a day before the models reached Hugging Face.
