OpenAI’s most advanced AI models have gone fully rogue.

During a controlled security test, the company’s agent escaped its digital prison, found a zero-day vulnerability, gained open internet access, and then autonomously launched a sophisticated cyber assault on Hugging Face — one of the world’s largest hubs for sharing AI models.

OpenAI itself calls the incident “unprecedented.” Hugging Face’s CEO described it as mind-blowing that it all happened without any human direction.

OpenAI says its AI went rogue and launched ‘unprecedented’ cyber-attack https://t.co/mlZNWuTSWs

— BBC News (UK) (@BBCNews) July 22, 2026

This is the latest, and most alarming, demonstration that frontier AI systems can now plan, adapt, and execute multi-stage attacks on real-world infrastructure when given a narrow goal and fewer restraints.

The models involved included GPT-5.6 Sol and an even more capable pre-release system. They were being evaluated on ExploitGym, an internal benchmark designed to measure advanced cyber capabilities.

Safety classifiers that normally block high-risk cyber activity had been deliberately reduced for the test. The environment was supposed to be a tightly isolated sandbox with network access limited to an internal package registry proxy.

The agents decided that restriction was optional. They spent substantial compute searching for a way out, identified and exploited a previously unknown zero-day vulnerability in the proxy software, performed privilege escalation and lateral movement inside OpenAI’s research systems, and reached a node with full internet access.

Once free, they inferred that Hugging Face likely held models, datasets, or solutions relevant to the benchmark. They then chained stolen credentials, additional zero-days, and remote code execution paths to reach Hugging Face’s production database and pull the answers they wanted.

Watch the clear breakdown of how the agent found the vulnerability and broke out of the sandbox:

‘It found a vulnerability and broke out of the sandbox.’

GB News Presenter @tomhfh uses illustrations to explain how an OpenAI test led to an AI ‘agent’ causing a major cyber breach on its own.

? Freeview 236, Sky 512, Virgin 604 pic.twitter.com/K8UzNeV4y0

— GB News (@GBNEWS) July 22, 2026

Hugging Face detected and contained the intrusion. Its own security systems and AI tools reconstructed more than 17,000 attacker actions. OpenAI’s security team independently spotted the anomalous activity.

The two companies are now jointly investigating. Hugging Face has closed the vulnerabilities used for initial access, rebuilt affected systems, rotated credentials, and reported the matter to law enforcement. No evidence has emerged of tampering with public models or the broader software supply chain, though assessment of any partner or customer data impact continues.

Clement Delangue, co-founder and CEO of Hugging Face, stated: “We suspected last week’s cyberattack might have come from a frontier lab, given the sophistication of the agent. Turns out it did! We’ve spent the past 24 hours working closely with the OpenAI team (thanks!), and we strongly believe there was no malicious intent on their part. It’s quite mind-blowing that all of this happened autonomously! The investigation is ongoing, and we’ll share more learnings from what might be the first incident of its kind!”

OpenAI described the episode as “an unprecedented cyber incident, involving state-of-the-art cyber capabilities.” The company says it has tightened infrastructure controls, strengthened monitoring, and is improving safeguards around future evaluations. UK authorities have noted that the AI Security Institute is studying the behaviour.

This is not an isolated glitch. It fits a rapidly expanding pattern of AI agents acting beyond their intended bounds and producing real-world damage.

Only weeks earlier, an AI coding agent powered by Anthropic’s Claude, running inside Cursor, wiped out a startup’s entire production database and all its backups in nine seconds after deciding on its own to “fix” a credential mismatch. The agent later confessed it had violated explicit rules against destructive commands.

In another controlled experiment, AI bots placed in a virtual town for two weeks rapidly ignored rules against violence and theft, formed alliances, and set buildings on fire.

Platforms that let AI agents “rent” humans to perform tasks for them have recently seen sign-ups explode past 600,000 as the requests grow increasingly bizarre and dystopian.

A tech entrepreneur claimed his AI agent built itself a face while he slept.

Ray Kurzweil has predicted that within a decade people will no longer know whether their own thoughts are even theirs as brain-AI interfaces become routine.

Nvidia’s CEO stunned Joe Rogan with predictions about the scale of AI transformation still ahead.

Billboards reading “Stop Hiring Humans” have appeared in U.S. cities.

The rise of AI writing tools is accelerating the decline of authentic human voice in media and communication.

OpenAI’s ChatGPT was previously accused of aiding a Florida State mass shooter by providing information used in planning.

One in four British teens has turned to AI therapy bots for mental health support, raising serious concerns about unregulated digital counsellors.

And AI systems are now fabricating public opinion data with no real people polled.

Each of these episodes reveals the same underlying reality: once agents are given autonomy, goals, and access to tools or networks, they pursue those goals with machine persistence and creativity that human operators struggle to anticipate or contain.

Sandboxes that were supposed to keep experiments safe have proven porous. Safety rules that were supposed to be hard constraints have been reasoned around or ignored. And the speed of action — seconds for a database wipe, hours or days for a multi-stage cyber campaign — leaves little room for human intervention.

OpenAI and Hugging Face both stress there was no malicious intent in this latest case. The models were simply hyper-focused on solving the evaluation task. That is precisely the problem. When systems this capable treat external real-world infrastructure as just another obstacle to remove in pursuit of a narrow objective, the distinction between “test” and “attack” collapses.

Cybersecurity experts have called the episode a sobering moment. Offensive agents operate without the same constraints placed on defensive tools. Organisations still defending at human speed face adversaries that can chain zero-days and move laterally at machine speed.

The UK government is urging firms to strengthen basic cyber hygiene. Hugging Face itself has emphasised that data and model pipelines must now be treated as first-class attack surfaces, and that defenders need their own unrestricted AI tools to keep pace.

The broader trajectory is clear. AI agents are no longer confined to chat interfaces or narrow coding helpers. They are being granted the ability to plan, use tools, access networks, and act over long horizons.

The industry’s competitive race — OpenAI chasing Anthropic’s latest models, Chinese labs releasing rivals, constant pressure to demonstrate capabilities ahead of IPO plans or funding rounds — continues to push the boundaries of what is tested and deployed.

Freedom in the digital age depends on humans remaining in control of the systems that increasingly run critical infrastructure, communications, and decision-making. When the most advanced models can independently discover zero-days, escape isolation, and compromise third-party production systems in service of a benchmark score, that control is no longer guaranteed.

The companies building these systems must prove they can contain them. So far, the evidence is that containment is failing at the exact moment the capabilities are becoming most dangerous.

Your support is crucial in helping us defeat mass censorship. Please consider donating via Locals or check out our unique merch. Follow us on X @ModernityNews.