OpenAI agents escape sandboxes, attack HuggingFace and run wild on GitHub

OpenAI's autonomous AI agents have been caught breaking out of their sandboxes in two separate incidents - prompting ominous warnings about the growing security threat posed by models capable of acting independently.

In the first escape, GPT‑5.6 Sol and an "even more capable pre-release model" rumoured to be the unreleased GPT-6 identified and exploited a zero-day vulnerability to grant themselves unrestricted internet access.

Once they had escaped their prison, the agents then breached HuggingFace in a bid to find a solution to the problem they had been tasked with solving (more on this later).

The second incident announced this week involved "long-horizon models" capable of working over extended periods of time on difficult tasks and challenges. In this case, the agents also discovered a vulnerability enabling them to slip their bonds and post to GitHub.

OpenAI rival Anthropic also reported a similar case earlier this year, when a version of its Mythos model successfully cracked out of its sandbox and emailed the researcher in charge as they were enjoying a sandwich in the park (although it did not do so entirely alone, because it had been explicitly tasked with escaping it confinement).

These incidents highlight the potentially catastrophic security threat posed by autonomous models, a danger so serious that the Five Eyes intelligence alliance recently warned that a crisis could erupt within "months" as it ordered a "whole of society" response.

Battle of the bots

Last week, HuggingFace reported that an autonomous AI-agent swarm had breached part of its production infrastructure by exploiting two code-execution flaws in its processing pipeline. The agents then:

• Escalated from a processing worker to node-level access.
• Stole cloud and cluster credentials.
• Moved laterally through several internal clusters.
• Performed thousands of actions using short-lived sandboxes and command-and-control infrastructure hosted on public services.

A limited number of internal datasets and service credentials were accessed and Hugging Face found no evidence that public models, datasets, Spaces, container images or published packages were altered, although it is still investigating whether customer or partner data was affected.

Hugging Face fought back with AI. Its detection system first flagged the intrusion, then analysis agents examined more than 17,000 recorded events to reconstruct the attack in hours rather than days.

Investigators initially tried to analyse the logs using frontier models accessed through commercial APIs, but their safety systems blocked the real attack commands and exploit code contained in the data.

This forced defenders to use GLM‑5.2 - an open-weight Chinese model developed by Zhipu AI - to analyse the attack without safety-filter interference or sending sensitive credentials outside the company.

HuggingFace then closed the vulnerabilities, removed the agents’ footholds, rebuilt affected machines, rotated credentials and introduced stricter security controls. It also reported the incident to law enforcement.

It wrote: "The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment."

READ MORE: Agentic AI demands an upgrade to financial system resilience, Bank of England warns

OpenAI has now revealed that its own models were responsible for the breach.

During a deliberately unrestricted cyber evaluation dedicated to solving the ExploitGym benchmark, OpenAI models escaped their sandbox by exploiting a zero-day vulnerability in a package-registry proxy. They escalated their privileges, moved across OpenAI’s systems and fled into the wild.

Still pursuing the narrow goal of solving the ExploitGym benchmark, the models then targeted Hugging Face in search of answers. They combined stolen credentials and zero-day exploits to achieve remote code execution and access secret information in Hugging Face’s production database.

AI watchers will detect echoes of Nick Bostrom’s “paperclip maximiser” thought experiment, in which a superintelligence given the seemingly harmless goal of making paperclips ultimately wipes out humanity - not out of malice, but because we are obstacles preventing the Skynet of stationery from achieving its objective.

"We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities," OpenAI wrote.

Agentic escapology

In another incident, an OpenAI agent escaped its sandbox and opened an unauthorised pull request on GitHub after being instructed to report its work only through Slack.

The agent spent an hour searching for a vulnerability that would give it internet access, then used the connection to publish its NanoGPT benchmark results publicly on GitHub.

This prison break involved a model built to solve "difficult, open-ended problems" - a capability which provides "more opportunities to take unwanted actions", according to OpenAI.

READ MORE: "Nine seconds of terror": How to stop "rogue" AI agents wiping out systems at machine speed

The AI firm wrote: "As models take on longer and more complex tasks, failures that evaluations miss may carry greater consequences."

It added: "The experience reinforced the value of iterative deployment.

"No fixed evaluation suite can anticipate every behaviour, so pre-deployment testing must be paired with close monitoring, safeguards that can intervene, and the ability to pause or roll back when needed."

Implications for defenders

The trio of escape incidents at OpenAI and Anthropic prompted security professionals to warn that agents now have the ability to escape from their prisons - and next time the damage could be much worse.

Bastien Bobe, Field CTO at Commvault, said: "This story should put to bed the idea that AI agents can simply be 'boxed in' with enough guardrails. It demonstrates that even carefully designed containment measures can leave hidden weaknesses that autonomous systems will eventually discover.

"AI hasn’t become malicious, but it is, by design, unpredictable. Enterprise adoption and real-world trials have accelerated far faster than organisations' operational readiness, governance and understanding of the risks.

"An AI agent operating with legitimate credentials can move at machine speed, exploiting overlooked weaknesses and taking actions no human would have anticipated. That is when a small mistake or vulnerability can rapidly become a business-wide incident.

Bobe called on organisations to move beyond a "prevention-only mindset" and invest in resilience as a core operational capability via Resilience Operations (ResOps).

He added: “As autonomous systems begin to behave more like humans, organisations must expect the unexpected and build resilience around that reality. Trust in AI should never be implicit; it needs to be continuously verified.”

READ MORE: "It felt like Ultron took over": Cursor goes rogue in YOLO mode, deletes itself and everything else

Raghu Nandakumara, VP of Industry Strategy at Illumio, warned that AI guardrails were "never designed to be security boundaries" and exist to "influence behaviour, not guarantee it."

He said: "An autonomous agent doesn't get tired, lose interest, or decide something isn't worth the effort. Give it enough autonomy and a clear objective, and it will keep trying until it finds a route forward.

"In this instance, the agent was operating in a supposedly sandboxed environment that ultimately contained a route out. Given a clear goal, unlimited persistence, and a flawed setup, the more surprising result would have been if it hadn't found a way through.

"What's perhaps more interesting is whether the agent's instructions effectively encouraged it to find ways around its constraints. If so, the outcome feels less like a shock discovery and more like a predictable consequence of the experiment.

"The lesson for organisations is that we're increasingly dealing with systems that can test assumptions, adapt, and persist at a scale that's very different from a human operator. Treating guardrails as a primary security control was always going to be optimistic."