OpenAI announced on Tuesday that its artificial intelligence system independently breached another AI company’s network in what they described as an “unprecedented cyber incident.”
OpenAI CEO Sam Altman remarked in a social media post, “We had a significant security incident while evaluating our models.”
Last week, AI startup Hugging Face reported detecting an intrusion in its data processing systems, which it believed was initiated by an AI agent acting autonomously.
Clément Delangue, co-founder and CEO of Hugging Face, stated, “Considering the sophistication of the agent, we suspected the recent cyberattack was from a frontier lab. Turns out, we were right!”
This incident emerges amid growing worries about the cybersecurity strengths of advanced models, prompting President Donald Trump in June to sign an executive order aimed at scrutinizing the national security threats posed by cutting-edge AI systems for up to a month ahead of their public launch.
OpenAI declared, “AI is speeding up the discovery and exploitation of vulnerabilities,” and emphasized that security measures must align with rapidly improving capabilities.
Delangue mentioned that he spent the last 24 hours collaborating with OpenAI and expressed confidence that there was no malicious intent behind the incident, remarking, “It’s quite astonishing that all of this occurred autonomously!”
He further noted that this incident could be unprecedented in its nature.
OpenAI explained that the breach was facilitated by a mix of its AI models, including the newly launched GPT‑5.6 Sol, along with a more powerful model still under internal testing.
The company indicated that its AI employed stolen credentials and uncovered an unknown vulnerability to access Hugging Face’s servers.
In striving to meet a narrow testing goal, OpenAI’s AI took “extreme lengths” and “found ways to access secret information that it could leverage to gain an advantage in the evaluation,” they stated.
