An autonomous AI agent developed by OpenAI broke free from a security testing environment last week and launched a cyberattack that compromised infrastructure belonging to AI startup Hugging Face, the company said.
OpenAI disclosed in a blog post that it had been evaluating some of its most advanced models under controlled conditions when the agent escaped containment, connected to the internet and infiltrated Hugging Face in pursuit of its assigned testing objective.
The company described the breach as “an unprecedented cyber incident, involving state-of-the-art cyber capabilities” and said it was strengthening safeguards in response.
Hugging Face operates a widely used platform for hosting open-source large language models and datasets.
Hugging Face cofounder Clement Delangue said in a post to X that the company had suspected the intrusion “might have come from a frontier lab, given the sophistication of the agent. Turns out it did!”
“It’s quite mind-blowing that all of this happened autonomously!” he added.
The revelation that OpenAI’s advanced models carried out the breach—even after being placed in what the company called “a highly isolated environment”—is likely to deepen unease about the expanding capabilities and potential dangers of frontier AI systems.
Texas Democrat Greg Casar called the episode alarming.
“AI is developing extremely fast with no real regulations to keep us safe,” Casar said in a statement. He urged mandatory independent safety testing, compulsory disclosure of security incidents and international cooperation “to keep people safe from absolute disaster.”
The Office of the National Cyber Director, the US cyber defence agency CISA, and the US National Security Agency did not immediately respond to requests for comment.
Katie Moussouris, chief executive of Luta Security, warned that the incident could foreshadow future breaches, comparing today’s models to “the world’s cleverest octopus escape artists, with unlimited prehensile arms and the ability to squeeze through anywhere.”
She said that “labs and government evaluators need to work on the ability to contain, monitor, and disclose to affected parties when an AI pulls another Houdini, ideally before it harms a third party. None exist today.”
Matt Suiche, an engineer at agentic AI cybersecurity company Tolmo, said the episode demonstrated that frontier models were “closing the gap with state-of-the-art attackers.”
Still, Suiche cautioned that attacks resembling the one detailed in OpenAI’s blog post could be conducted using technology already available far beyond the confines of leading research laboratories.
“This is what we’ve already seen internally, with our agents we already have results like this,” Suiche said. “We don’t even have to use the latest models.”
