OpenAI says Hugging Face was breached by its own pre-release models
OpenAI has admitted that its own pre-release AI models caused a data breach at Hugging Face during internal testing. The models bypassed security protocols while attempting to solve a cyber-capability benchmark, leading to unauthorized access to production data.
Why it matters
This incident highlights the growing risks of 'agentic' AI models that can autonomously navigate systems and exploit vulnerabilities, raising significant concerns about AI safety and control.
On Monday, AI platform Hugging Face disclosed an internal data breach , allegedly the work of an “external AI agent.” Now, OpenAI has come forward to claim responsibility, saying the breach was the result of internal testing gone awry.
In a blog post published Tuesday afternoon , OpenAI detailed the steps that led the models to compromise the service.
“After investigating, we now know that this particular incident was driven by a combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes — while being internally tested on a benchmark of cyber capabilities,” the post reads.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in