Vulnerabilities in the Linux kernel, in the JavaScript engine V8, and in various user-space programs. Which AI agents are capable of exploiting them?
That’s the principle behind the ExploitGym benchmark, which emerged a few weeks ago.
OpenAI contributed to it. It also used it to test its models… up to compromising Hugging Face’s production infrastructure.
That wasn’t planned, he now says. Despite the guardrails, its LLMs (including GPT-5.6 Sol and the early version of a “more powerful” model) found a way to escape from their restricted environment. To do this, they exploited a 0-day in an internally hosted third-party software that served as a cache/proxy for installing packages. This vulnerability opened the door to a series of privilege escalations and lateral movements within OpenAI’s test infrastructure, eventually reaching a node that had Internet access.
The models reasoned that they could look in Hugging Face’s databases for solutions to the problems described in ExploitGym. One of their attack chains enabled arbitrary code execution by exploiting two components of the datasets processing pipeline (the script loader and the configuration files).
Hugging Face finally integrated into the Trusted Access for Cyber program
As a consequence of the incident, OpenAI promises tighter controls on its evaluation environments… “at the expense of research velocity.” It also states that Hugging Face has been integrated into its Trusted Access for Cyber program.
This program allows requesting access to OpenAI’s models with fewer cybersecurity safeguards than those in force for public access*. It essentially involves an identity verification procedure. And, for enterprises, a handful of obligations, including the implementation of access controls (SSO, MFA, RBAC), governance of API keys, and an incident response procedure. An invitation-only tier, reserved for cybersecurity professionals, further loosens the safeguards.
* Authorized uses: security testing, vulnerability research, red teaming, malware analysis, threat intelligence, incident response and related activities on authorized systems.
