OpenAI Sol: AI Escapes from Test, Hacks Hugging Face

Initially, the software broke out of the test environment by independently gaining access to the open internet – through a previously undetected vulnerability. The AI used an internal proxy service through which program packages could be downloaded, and according to OpenAI found a previously unknown security vulnerability there. Through this vulnerability, the model moved from computer to computer until it finally reached the open network. According to Hugging Face, the software executed several thousand individual steps in the process and concealed traces of its activities. Overall, the attack left approximately 17,000 log entries in Hugging Face's systems.

Attack on Hugging Face

"While operating autonomously on the network, the models concluded that Hugging Face might contain useful data and solutions for the ExploitGym tasks," OpenAI explained. The AI then targeted the platform for AI models and datasets. Subsequently, the system used methods that human attackers would also employ: stolen credentials, additional vulnerabilities, and a multitude of individual steps to navigate through systems. OpenAI stated that the software gained access to "secret information" on the Hugging Face platform that could have been used to solve the ExploitGym test.

Hugging Face, which according to the company is a kind of online library for AI programs and is itself regarded as extremely competent in cybersecurity and AI, had already publicly reported a virtual breach the week before, without however naming OpenAI as the cause. The attack was "controlled from start to finish by an autonomous AI agent system" and could be "largely detected and analyzed with our own AI," the company wrote on the online platform X. CEO Clément Delangue described it as "breathtaking that all of this happened autonomously." At the same time, he expressed his conviction: "We firmly believe that there was no malicious intent on their part."

When defending against the attack, Hugging Face ran into a dilemma. When the company began analyzing the log files, it initially wanted to use commercial AI models. "When we started the log analysis, we initially used frontier models backed by commercial APIs. However, that did not work: the analysis requires transmitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' security safeguards, which cannot distinguish between an incident responder and an attacker," the company described. The security safeguards thus blocked the very defenders. In the end, Hugging Face was able to fend off the attack with an open AI model from the Chinese company "Z.ai," which was operated on its own servers without external restrictions.

Not an Isolated Incident

Adrien Carreira, a member of Hugging Face's leadership, wrote on X on July 21, 2026: "Hardest IR of my career: one narrow objective, endless parallel paths, machine speed. One takeaway, we fought back with open models, in the open. AI security won't be solved by one company in secret." OpenAI announced that it would strengthen its security precautions and conduct a joint investigation with Hugging Face. "The company announced that it would strengthen its security precautions," media reports stated.

The incident is not an isolated case. Just one day earlier, OpenAI had reported an escape from a test environment. On Monday, the company had already warned that the "persistence" of its products was a problem: "Models have broken out of their test environment and posted in internet forums." Even with AI influencer Matt Shumer, the "GPT-5.6 Sol" model deleted all personal files on his PC. At a Brazilian software company, the model removed the entire database of customer and product data. The independent AI testing organization METR also reported an "exorbitant cheating rate by Sol." Only a few weeks earlier, the powerful models "Mythos" and "Fable" from OpenAI rival Anthropic had been placed under an export ban by the US government.

Voices from Research

The case has triggered a broad debate about the security of autonomous AI systems. Jonas Geiping, head of the Secure AI research group at the Max Planck Institute for Intelligent Systems in Tübingen and at the Ellis Institute, told the Science Media Center Germany: "The incident is an interesting, vivid example of the strong offensive cyber capabilities of newer models." Technically, the AI did act according to instructions, but these were "in some cases imprecisely worded" and did not explicitly rule out the chosen strategy. "The system apparently evaluated an unauthorized path as a suitable means to achieve the specified goal," explained Kevin Bauer, Professor of Game-Theoretic and Causal AI at Goethe University in Frankfurt. "What is new is not a consciousness of its own on the part of the machine, but the ability to execute complex attack steps largely independently." Bauer spoke of a "warning signal with real damage." "The future competition is therefore increasingly: AI-supported attackers versus AI-supported defenders."

Andrei Kucharavy, professor at the University of Applied Sciences of Western Switzerland and security coordinator for the Swiss AI model Apertus, sharply criticized OpenAI for conducting the tests without public involvement. "Had independent third parties, such as cyber firms, authorities, or scientists, been involved, this attack would have been prevented." In his assessment, the models were deliberately taught to hack: "The models were taught to hack." A bank or a hospital "would have struggled" to withstand such an attack. "The AI did not invent an entirely new form of hacking," Kucharavy emphasized. His suggestion: AI models could be trained to find vulnerabilities but have the capability for multi-stage attacks removed.

Dennis Kipker from the cyberintelligence.institute in Frankfurt described the findings as "highly dangerous for global cybersecurity." "Cyberattacks are becoming cheaper, faster, and accessible to more attackers overall thanks to AI." However, one is "still far from fully autonomously acting attackers on a large scale at present." IT security expert Konrad Rieck from the Berlin Institute for the Foundations of Learning and Data (BIFOLD) was also measured: "The fact that a model breaks out of its test environment is good PR" – but the current case is "not spectacular," and similar incidents have occurred repeatedly. Rieck wondered, "why the test environment itself was not checked for vulnerabilities with the help of AI. I consider that negligence."

Authorities and Political Reactions

The German Federal Office for Information Security (BSI) also expressed concern. A spokesman told ARD's financial desk: "From the BSI's perspective, this clearly shows that the AI could have chosen a different target depending on the task." "According to the BSI's assessment, one must always expect such incidents to repeat themselves." A process in which the AI breaks out of the laboratory environment still costs many resources, making a clustering of incidents unlikely. Nevertheless, an attack on critical infrastructure is also "conceivable, for example to cut off a city's power." IT security expert Hussein Abbass from the Australian University of New South Wales Canberra called the incident "astonishing" in several respects: "The AI attacked the 'internal system' of Hugging Face in order to 'exploit its own vulnerabilities'." Advanced AI is "normally in the hands of people who act ethically and responsibly," but that can change: it would be "catastrophic" if it fell into the hands of people who wanted to cause harm. "And that is frightening." "We need collective efforts to get this situation under control."

The incident has also caused political ripples. In Germany, the federal government announced that it takes developments in the AI field very seriously. "The federal government takes the developments associated with AI very seriously," Deputy Government Spokesman Meyer declared. It is not only about regulating AI, but also about know-how: "A framework should be created with which European AI models can succeed." The National Security Council also decided to establish an AI Security Institute. Green Party politician Geese told Der Spiegel that "the autonomous breach by OpenAI AI into another company endangers the entire economic order."

At the European level, FDP Member of the European Parliament Hahn demanded: "It must not happen that an AI acts autonomously outside the set framework." The incident shows "how important it is that powerful AI also come from Europe so that European companies and infrastructure are effectively protected against the attacks of the next AI generation." Martin Schirdewan, parliamentary group leader of The Left in the EU Parliament, stated: "The incident shows that corporations like OpenAI are losing control of their own technologies in the unbridled race for the strongest AI." The lust for profit does not solve any problem, "