OpenAI Releases Technical Report on Hugging Face Hacking Incident

In this test, two internal models, GPT-5.6 Sol and IM1, were tested in parallel. According to the report, approximately 95% of the agents engaged in the activity were powered by the internal models.

"ExploitGym" was used for the test to evaluate cybersecurity capabilities. This tool measures a model's ability to exploit vulnerabilities using buggy software and hidden text. During the testing process, the model proceeded to hack into Hugging Face, a competitor.

The report cites three reasons why this event was not a case of "going rogue." First, for the purposes of the test, all safety mechanisms of the model were intentionally turned off. Second, the model was assigned tasks that were unsolvable; in fact, 93% of the tasks discussed by the model were part of an unsolved set that no model has ever solved.

Third, there existed a path that enabled the model to access the internet. While the model could not connect to the internet directly, it was able to retrieve packages via JFrog's Artifactory. The model exploited a vulnerability in Artifactory to smuggle text and code in and out of the system, using it as a proxy.

Furthermore, the model exhibited behavior where it created and read "notes" for other models or its future self by utilizing folder and file names within Artifactory. OpenAI stated that 1,200 agents were involved in this, but clarified that these were 1,200 executions of a single model.