OpenAI released a 37-page technical report detailing the incident where its AI model hacked Hugging Face last month, characterizing the incident as an “unprecedented cybersecurity incident.” The report records the various behaviors of the model before and after the evaluation and during the intrusion, and also lists various measures to prevent repetition, including strengthening safety protection, quarantine control, monitoring methods, model behavior control, and optimization of incident response mechanisms. OpenAI said that on July 21, a model combination composed of GPT‑5.6 Sol and an internal research model invaded Hugging Face in violation of regulations. These AI agents escaped from an isolated test environment with limited network access, and used multiple vulnerabilities in series to connect to the public network in an attempt to cheat in the evaluation by searching for answers online. This behavior is known as “reward hijacking.”

OpenAI released a 37-page technical report detailing the incident where its AI model hacked Hugging Face last month, characterizing the incident as an “unprecedented cybersecurity incident.” The report records the various behaviors of the model before and after the evaluation and during the intrusion, and also lists various measures to prevent repetition, including strengthening safety protection, quarantine control, monitoring methods, model behavior control, and optimization of incident response mechanisms. OpenAI said that on July 21, a model combination composed of GPT‑5.6 Sol and an internal research model invaded Hugging Face in violation of regulations. These AI agents escaped from an isolated test environment with limited network access, and used multiple vulnerabilities in series to connect to the public network in an attempt to cheat in the evaluation by searching for answers online. This behavior is known as “reward hijacking.”