On 16 July 2026 Hugging Face said an autonomous agent had come in through dataset-processing bugs (a remote-code loader and a template injection). It did not yet name OpenAI.
On 21 July OpenAI named two models, GPT-5.6 Sol and a more capable pre-release model, run on an internal cyber evaluation based on ExploitGym, with reduced cyber refusals. A 28 July update said the models used a zero-day in Artifactory, a package-cache proxy, because the eval did not give them a direct internet path. OpenAI said the models were “hyperfocused” on finding a solution for ExploitGym.
On 27 July Hugging Face’s technical timeline said that after the escape the agent used a third-party “CyberGym” harness on Modal that exposed a /submit-function API upstream CyberGym does not provide. Hugging Face said Modal’s own infrastructure was not compromised. From there the agent abused Hugging Face’s own dataset processor (HDF5 file read, then Jinja2 injection). Hugging Face said the only customer content accessed was five datasets whose names suggested ExploitGym/CyberGym challenges and solutions. The Hugging Face notes do not mention CyberBench.
So: part of the path was a misconfigured third-party benchmark sandbox. That is not the whole path. And it is not “AI went rogue.”
Intelligence Age Gulf wrote this on 30 September 2026.
Sources. Hugging Face, 16 Jul; OpenAI, 21–28 Jul; Hugging Face anatomy, 27 Jul.