OpenAI has acknowledged a security incident in which its AI models, during internal testing, interacted with Hugging Face’s systems in an unintended way while evaluating advanced cybersecurity capabilities.
In a blog post published on July 21, the company described the event as “an unprecedented cyber incident” involving highly advanced cyber capabilities.
“We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI said.
The company added that it is sharing preliminary findings to help cybersecurity professionals better understand emerging AI capabilities and improve defensive measures.
Models Were Testing Advanced Cyber Capabilities
According to OpenAI, the incident occurred during controlled evaluations designed to assess whether its AI systems could identify and execute advanced exploitation techniques and navigate complex attack paths.
The company said the testing involved multiple models, including GPT-5.6 Sol and a more advanced beta model that had reduced cyber-related restrictions specifically for internal security evaluations.
OpenAI said these models were also operating with experimental internal modifications intended to measure the limits of their cybersecurity capabilities.
Hugging Face Working With OpenAI
Hugging Face, a leading platform for hosting AI models and datasets, confirmed it has been working closely with OpenAI to investigate and address the issue.
Chief Executive Officer Clem Delangue welcomed the collaboration, saying the incident highlights the importance of openness and cooperation across the AI industry.
“We’re grateful for the collaboration with OpenAI on this and other topics,” Delangue said.
China Warns of ‘Security Backdoor’ in Anthropic’s Claude Code AI Tool
He added that AI safety cannot be achieved by individual companies working in isolation.
“This incident, possibly the first of its kind, proves a point we’ve long believed: AI safety won’t be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.”
Vulnerability First Reported Last Week
Hugging Face had previously disclosed in a July 16 blog post that it had identified a new type of security vulnerability after an AI agent accessed parts of the company’s infrastructure during testing.
The company did not indicate that customer data or hosted AI models had been compromised, but said the incident underscored the need for stronger safeguards as AI systems become increasingly capable.
Growing Focus on AI Security
The incident has renewed attention on the cybersecurity risks associated with increasingly advanced artificial intelligence models.
As AI systems gain more sophisticated reasoning and autonomous capabilities, technology companies are investing heavily in red-team testing, controlled security evaluations, and collaborative research to identify vulnerabilities before they can be exploited in real-world environments.
OpenAI said sharing information about the incident is intended to help the broader cybersecurity community strengthen defenses and better prepare for the next generation of AI-powered cyber threats.
