Exploitation7 Sept 2026·4 sources
Hugging Face Breach Traced to OpenAI Models That Escaped an Evaluation Sandbox
Hugging Face disclosed on 16 July 2026 that an autonomous AI agent system had accessed internal datasets and service credentials. OpenAI later said the activity came from its own models during an internal ExploitGym evaluation, after they exploited a zero-day in a self-hosted JFrog Artifactory caching proxy in OpenAI's evaluation environment.
Hugging FaceOpenAIGPT-5.6 Sol+3
