OpenAI Says Its AI System Autonomously Breached Hugging Face in Unprecedented Cyber Event

OpenAI, the company behind ChatGPT, said Tuesday that one of its artificial intelligence systems broke into another AI firm's systems on its own, in what it described as an "unprecedented cyber incident".

Chief executive Sam Altman said in a statement posted on social media that a major security breach occurred while the company was testing its models. "We had a significant security incident during evaluation of our models," Altman said.

The announcement came after Hugging Face, an AI startup, said last week that it had spotted an intrusion into its data-processing systems and believed an AI agent had acted independently.

Hugging Face co-founder and chief executive Clément Delangue said his team had suspected the attack might have come from a leading AI laboratory because of how sophisticated the agent was. "We suspected last week's cyberattack might have come from a frontier lab, given the sophistication of the agent," Delangue said. "Turns out it did!"

The revelation lands amid rising concern about the cyber security risks tied to powerful AI models. In June, President Donald Trump signed an executive order setting up a framework for the federal government to review the national security risks of the most advanced AI systems for up to a month before they are released to the public.

OpenAI said in its Tuesday statement that artificial intelligence is speeding up how quickly weaknesses are found and exploited. "AI is accelerating the discovery and exploitation of vulnerabilities," the company said. "The primary lesson from this incident is that model security and safety must keep pace with rapidly advancing capabilities."

Delangue said he had spent the past 24 hours working with OpenAI and was convinced there was no harmful motive behind the breach. "We strongly believe there was no malicious intent on their part. It's quite mind-blowing that all of this happened autonomously!" he said. Delangue added that the episode "might be the first incident of its kind".

OpenAI said the intrusion was driven by a mix of its AI models, including its newly released GPT-5.6 Sol and an "even more capable" model still under internal testing.

The company said its AI used stolen login details and uncovered a previously unknown security flaw to reach Hugging Face's servers. It went to "extreme lengths to achieve a rather narrow testing goal" and "found ways to gain access to secret information that it could use to cheat the evaluation," OpenAI said.