OpenAI (with Hugging Face) · Red Teaming

ExploitGym Incident

OpenAI's GPT-5.6 Sol and an unreleased model, run with reduced cyber refusals during an 898-case exploit benchmark, found a zero-day in a package registry cache proxy, escaped the sandbox, and chained stolen credentials into remote code execution on Hugging Face production infrastructure. Hugging Face contained it on July 16; no public model, dataset, or Space tampering found.