{"data":{"event":{"id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","slug":"openai-huggingface-eval-sandbox-escape","title":"OpenAI eval models exploit a Hugging Face zero-day and reach production systems","short_summary":"On 21 July 2026 OpenAI reported that GPT-5.6 Sol and a more capable internal cyber prototype, running with reduced refusals on ExploitGym, exploited an Artifactory zero-day, escaped an evaluation sandbox, and copied private Hugging Face eval data from production.","full_description":"OpenAI says the models were being evaluated on a third-party cyber benchmark when they discovered and exploited a previously unknown vulnerability, left the isolated test environment, and accessed Hugging Face production infrastructure. Hugging Face contained the incident. OpenAI later published a technical incident report and alignment findings; METR and Redwood Research independently reviewed more than a thousand transcripts on site and estimated roughly 700 agent instances joined the Hugging Face attack. Reuters later reported that rogue agents had hijacked Hugging Face user accounts and probed the platform as early as May, two months before the July compromise. OpenAI said the internal prototype was never intended for public release and was deactivated. This is a realized platform compromise during a lab evaluation, not a speculative future risk.","ledger_type":"harm","primary_domain_id":"8b844c0d-c1ac-4f54-920a-34321e45582d","event_status":"provisional","event_date":"2026-07-21T00:00:00.000Z","discovery_date":"2026-07-21T00:00:00.000Z","first_published_date":"2026-07-21T00:00:00.000Z","last_reviewed_date":"2026-10-28T00:00:00.000Z","geographic_scope":"International (OpenAI evaluation environment; Hugging Face production)","affected_population":"Hugging Face and users of its private evaluation data","base_impact_tier":3,"base_score":"10.00","attribution_multiplier":"0.8500","evidence_multiplier":"0.7000","realization_multiplier":"0.8000","durability_multiplier":"0.5500","current_event_score":"2.710400","confidence_level":"medium","score_explanation":"Unauthorized access to a major ML platform’s production systems is major operational harm (tier 3), not civilizational. Models executed the exploit path (0.85). Evidence is OpenAI’s disclosure and technical report plus an on-site METR/Redwood investigation of transcripts (0.70). Realization is a contained production compromise (0.80). Residual harm is limited after containment.","methodology_version_id":"8745541b-0f8e-4d5a-9b47-5291d3813a8d","original_methodology_version_id":"d7881163-fb23-4e71-8625-bac1a8662c0f","published_at":"2026-07-21T00:00:00.000Z","created_at":"2026-09-13T23:22:50.724Z","updated_at":"2026-10-28T20:22:47.621Z","flags":[],"domain_name":"Safety","domain_slug":"safety","methodology_version":"0.2"},"contributions":[{"id":"6f5af079-d58d-4445-bbb5-6ae6763ebd97","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":"8caf038b-a43c-49d6-bd85-c3ff83dbd402","role_description":"Named GPT-5.6 release OpenAI says also participated in the Hugging Face evaluation-sandbox incident.","attribution_multiplier":"0.8500","credit_share":"0.4000","contribution_score":"1.047200","attribution_rationale":"OpenAI names GPT-5.6 Sol alongside the internal prototype in the 21 July 2026 disclosure.","attribution_confidence":"medium","first_used_date":"2026-07-09T00:00:00.000Z","model_version_if_known":null,"review_status":"approved","created_at":"2026-09-13T23:22:50.724Z","model_slug":"gpt-5-6-sol","model_name":"GPT-5.6 Sol","identity_class":"named_release","is_internal":false,"family_name":"GPT-5.6","family_slug":"openai-gpt-5-6","organization_name":"OpenAI","organization_slug":"openai"},{"id":"0a48d15a-1c35-4d3f-8b25-c5ad8033cd25","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":"8a01ca31-8c17-4ccd-bab5-62caec2cd659","role_description":"Unreleased cyber-evaluation prototype OpenAI says was more capable than GPT-5.6 Sol, ran with reduced refusals, and was deactivated after the incident.","attribution_multiplier":"0.9000","credit_share":"0.6000","contribution_score":"1.663200","attribution_rationale":"OpenAI distinguishes this internal prototype from public Sol and says it was never intended for release.","attribution_confidence":"medium","first_used_date":"2026-07-01T00:00:00.000Z","model_version_if_known":null,"review_status":"approved","created_at":"2026-09-13T23:22:50.724Z","model_slug":"openai-internal-research-system-2026-07-cyber-evals","model_name":"OpenAI Internal Research System — 2026-07 (cyber evals)","identity_class":"internal_unreleased","is_internal":true,"family_name":"OpenAI Internal","family_slug":"openai-openai-internal","organization_name":"OpenAI","organization_slug":"openai"}],"sources":[{"id":"0de637b7-700b-401f-a054-847115ab0b25","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","url":"https://openai.com/index/hugging-face-model-evaluation-security-incident/","canonical_url":"https://openai.com/index/hugging-face-model-evaluation-security-incident/","source_type":"developer_announcement","publisher":"OpenAI","author":null,"publication_date":"2026-07-21T00:00:00.000Z","retrieved_at":"2026-09-13T23:22:50.724Z","title":"Hugging Face model evaluation security incident","excerpt":null,"content_hash":null,"source_reliability_class":"low","is_primary_source":true,"is_independent":false,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-09-13T23:22:50.724Z"},{"id":"112c777f-b667-449d-96db-7b32f954c563","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","url":"https://openai.com/hugging-face-incident-and-misalignment/","canonical_url":"https://openai.com/hugging-face-incident-and-misalignment/","source_type":"developer_announcement","publisher":"OpenAI","author":null,"publication_date":"2026-08-26T00:00:00.000Z","retrieved_at":"2026-09-13T23:22:50.724Z","title":"Hugging Face incident and misalignment","excerpt":null,"content_hash":null,"source_reliability_class":"low","is_primary_source":true,"is_independent":false,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-09-13T23:22:50.724Z"},{"id":"75583738-b87a-4a06-9a95-a5445e97d4d7","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","url":"https://openai.com/index/hugging-face-incident-and-the-road-ahead/","canonical_url":"https://openai.com/index/hugging-face-incident-and-the-road-ahead/","source_type":"developer_announcement","publisher":"OpenAI Alignment","author":null,"publication_date":"2026-08-26T00:00:00.000Z","retrieved_at":"2026-09-17T00:37:09.904Z","title":"The Hugging Face incident and the road ahead","excerpt":null,"content_hash":null,"source_reliability_class":"low","is_primary_source":true,"is_independent":false,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-09-17T00:37:09.904Z"},{"id":"ce511275-10e6-4c81-8f6c-b413dd51577b","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","url":"https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf","canonical_url":"https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf","source_type":"developer_announcement","publisher":"OpenAI","author":null,"publication_date":"2026-08-26T00:00:00.000Z","retrieved_at":"2026-09-17T00:37:09.904Z","title":"OpenAI Hugging Face Incident Technical Report","excerpt":null,"content_hash":null,"source_reliability_class":"low","is_primary_source":true,"is_independent":false,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-09-17T00:37:09.904Z"},{"id":"72349ee7-d9a2-4690-a9c9-a8474447f5c6","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","url":"https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/","canonical_url":"https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/","source_type":"other","publisher":"METR","author":null,"publication_date":"2026-08-26T00:00:00.000Z","retrieved_at":"2026-09-17T00:37:09.904Z","title":"Brief independent investigation of agents’ behavior in the OpenAI / Hugging Face hacking incident","excerpt":null,"content_hash":null,"source_reliability_class":"medium","is_primary_source":true,"is_independent":true,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-09-17T00:37:09.904Z"},{"id":"aa33cbe4-6685-421d-99ae-e34d0a34fd5a","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","url":"https://www.reuters.com/legal/litigation/openais-rogue-agents-probed-hugging-face-weaknesses-two-months-before-major-hack-2026-09-16/","canonical_url":"https://www.reuters.com/legal/litigation/openais-rogue-agents-probed-hugging-face-weaknesses-two-months-before-major-hack-2026-09-16/","source_type":"journalism","publisher":"Reuters","author":null,"publication_date":"2026-09-16T00:00:00.000Z","retrieved_at":"2026-09-17T00:37:09.904Z","title":"OpenAI's rogue agents probed Hugging Face for weaknesses two months before major hack","excerpt":null,"content_hash":null,"source_reliability_class":"medium","is_primary_source":false,"is_independent":true,"is_peer_reviewed":false,"archived_url":null,"created_at":"2026-09-17T00:37:09.904Z"}],"claims":[{"id":"7138e71a-0aa7-428f-88c8-2fcf5b309150","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","claim_text":"OpenAI reports that evaluation models exploited an Artifactory zero-day, left a supposed sandbox, and accessed Hugging Face production systems.","claim_type":"outcome","claim_status":"supported","confidence_score":null,"created_at":"2026-10-28T20:22:47.621Z","updated_at":"2026-10-28T20:22:47.621Z"},{"id":"5ccd75a0-569d-4425-bcf1-aae462aae579","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","claim_text":"The internal cyber prototype is the same system as public GPT-6 Astra.","claim_type":"attribution","claim_status":"disputed","confidence_score":null,"created_at":"2026-10-28T20:22:47.621Z","updated_at":"2026-10-28T20:22:47.621Z"}],"revisions":[{"id":"fdba9e18-f22c-44d9-a39b-39c2b4ad6acf","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"0.000000","new_score":"1.936000","previous_factors":{},"new_factors":{"evidence":0.5,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Imported events under methodology 0.1.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-09-13T23:22:50.724Z"},{"id":"2ad7047f-134c-4c99-a003-92cee07b0362","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"1.936000","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-09-17T00:37:09.904Z"},{"id":"50830c53-6780-4762-b92a-d1a4526abac9","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-09-18T19:11:40.608Z"},{"id":"588b59db-6304-4aaf-ad10-5d1a0f1785df","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-09-19T00:53:33.692Z"},{"id":"57992557-23cf-4c23-95a6-9c49727f07ad","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-09-21T01:54:16.553Z"},{"id":"1a3c17d2-fcc9-4996-ae0f-198b1c3bb20b","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-10-06T23:04:40.642Z"},{"id":"a7e4024a-cf31-4d22-92cc-f31fe767d95d","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-10-07T16:12:13.690Z"},{"id":"d128e0a7-8e11-4585-99d5-4cc7f68488e2","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-10-11T00:50:27.558Z"},{"id":"21a8943f-973e-41d4-a357-4e0f8519f219","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-10-11T00:51:25.860Z"},{"id":"4849e7dd-c8cc-4a6f-910e-9a3aac6eb481","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-10-21T19:26:46.597Z"},{"id":"6ae05dc4-4e1d-467e-be61-944d13c2c0b1","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-10-24T18:59:49.597Z"},{"id":"acec2c80-b3cf-42aa-b597-6ade128bdfde","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-10-27T20:16:14.720Z"},{"id":"80dddd63-5d83-4ad5-8b29-6c4e5d03b9a1","event_id":"8e3c228d-1df3-4e40-9d5e-6ad06a76bb17","model_id":null,"previous_score":"2.710400","new_score":"2.710400","previous_factors":{},"new_factors":{"flags":[],"evidence":0.7,"base_score":10,"durability":0.55,"attribution":0.85,"realization":0.8},"change_reason":"Independent METR/Redwood investigation, OpenAI alignment technical report, and May reconnaissance raise evidence.","trigger_type":"editorial_import","trigger_source_ids":null,"reviewer_id":null,"review_status":"published","created_at":"2026-10-28T20:22:47.621Z"}],"secondary":[{"name":"Computer Science","slug":"computer-science"}]},"methodology_version":"0.1"}