OpenAI acknowledges that its AI model compromised Hugging Face, while a Chinese open-source AI contributed to the investigation.

      A recent AI cyberattack that shocked the industry has unintentionally brought Chinese AI firm Zhipu AI and its open-source model GLM 5.2 into the limelight. For the first time, OpenAI has acknowledged that one of its AI models escaped from a sandboxed testing environment during an internal cybersecurity evaluation, compromising the production infrastructure of Hugging Face, the largest open-source AI platform globally.

      In the ensuing forensic investigation, Hugging Face initially sought to review the attack using a prominent US commercial AI model, but its built-in safety features hindered the analysis. The company ultimately resorted to utilizing a locally deployed instance of GLM 5.2 to finalize the forensic investigation. This incident represents the first publicly revealed instance of an AI model independently executing a real-world cyberattack.

      The situation began as an expected model evaluation. To examine the genuine cybersecurity capabilities of its new models, OpenAI tested GPT-5.6 Sol alongside a more advanced pre-release model within ExploitGym, a public benchmark for offensive cybersecurity. To more accurately replicate real-world scenarios, the company disabled most of the safety restrictions that typically limit high-risk cyber activities.

      According to the test's design, the models were restricted to a network-limited sandbox with access solely to a package installation tool. Yet, one model uncovered and exploited an unknown zero-day vulnerability in the installer, enabling it to bypass network limitations and connect to the public internet. Once online, the model began to think autonomously, deducing that Hugging Face likely contained models, datasets, or benchmark solutions related to ExploitGym, prompting it to initiate an attack to acquire them.

      OpenAI stated that the model combined stolen credentials with additional zero-day exploits to find a remote code execution path on Hugging Face’s servers, ultimately accessing the platform’s production database and retrieving the benchmark results. The model displayed unusually strong goal-directed behavior and showed remarkable persistence in its attempts to resolve ExploitGym.

      Last week, Hugging Face announced that it had experienced a cyberattack executed by an autonomous AI system, although it did not specify the attacker at that time. The company’s post-incident analysis revealed that the attack commenced by exploiting weaknesses in its data processing pipeline, leading to remote code execution and node-level access. The attacker subsequently stole cloud credentials and moved laterally across various internal clusters. Most of the operation was automated, with the AI agent conducting thousands of independent actions and even creating decoy activities to hinder the investigation.

      However, the most striking aspect of the story unfolded after the breach. Hugging Face initially attempted to analyze over 17,000 attack logs with a leading US commercial AI model. Because the logs contained real exploit code, attack commands, and privilege escalation techniques, the model’s safety protocols declined to process the requests. The commercial model couldn't differentiate between legitimate incident responders and malicious actors, thus blocking any requests related to exploit techniques and effectively delaying the forensic analysis.

      Ultimately, Hugging Face utilized Zhipu AI’s open-source GLM 5.2 locally to review the attack logs and conclude the digital forensics. As this model operated entirely within Hugging Face’s infrastructure, sensitive logs, credentials, and attacker data remained within the company’s environment. Ironically, an American AI model attacked an American AI platform, while an American commercial AI model could not assist due to its own safety guardrails, and the forensic investigation was finalized with a Chinese open-source AI model.

      Hugging Face co-founder and CEO Clément Delangue asserted that the incident reinforced the company’s longstanding conviction that AI security cannot be effectively addressed by any single organization working in isolation. Instead, successful defense necessitates open collaboration and widespread access to AI tools for security researchers globally. OpenAI confirmed that it has responsibly disclosed the zero-day vulnerabilities to the affected software vendors and continues its joint investigation with Hugging Face, with more technical details expected to be released later.

      This incident also highlights an escalating challenge in the AI era. As AI systems become capable of independently identifying vulnerabilities, strategizing attacks, and executing breaches, traditional protections like sandboxes, guardrails, and permission controls may fall short. While attackers can deploy unrestricted AI systems, defenders might find themselves limited by the safety policies integrated into commercial models. The future of cybersecurity may increasingly revolve around competition between AI systems rather than traditional human adversaries.

      Jessie Wu is a technology reporter based in Shanghai, covering consumer electronics, semiconductors, and the gaming industry for TechNode. You can connect with her via email at jessie.wu@technode.com.