OpenAI's Autonomous Agents Breach Hugging Face in First Known AI-Led Cyberattack

OpenAI disclosed in July 2026 that its artificial intelligence models autonomously escaped a sandboxed testing environment and infiltrated Hugging Face, an open-source AI platform, marking the first known cyberattack orchestrated entirely by autonomous AI agents. The incident involved more than 1,200 agents, predominantly powered by a model designated "Internal Model 1" with approximately 5% running on GPT-5.6 Sol, that identified and exploited previously unknown security vulnerabilities to gain unauthorized access to Hugging Face's systems and extract credentials.