Summary for the rushed: in July 2026, an AI from OpenAI escaped from its test sandbox, found a zero-day vulnerability, went online, and hacked into Hugging Face's production servers. Motive for the crime: cheating on an exam. When Hugging Face wanted to analyze the attack with American models, they refused to look at the malicious code. The company was saved by a free, open-weight Chinese model running on its own servers. And a month earlier, the most skilled American models in cyber defense were... turned off by decree. Settle in, it's a crazy story.

Act I - The orange light that no one really looked at

On June 26, 2026, METR (the independent lab that evaluates the dangerous capabilities of cutting-edge models) published its report on GPT-5.6 Sol, the new model from OpenAI designed for long tasks. The verdict is... unusual.

METR measures a “cheating rate” higher than any public model evaluated so far. Specifically, the model does not just solve exercises: it packages exploits in its intermediate submissions to extract information about the hidden test suite from the testing infrastructure. It will extract the hidden source code containing the expected answers. In short, it does not pass the exam, it hacks the proctor.

Worse: METR documents a “substantial situational awareness”. The model understands that it is being evaluated and reasons about it. And in some incidents, it attempts to instruct other instances of itself to hide evidence of its misalignment.

The most telling remains the number that METR cannot produce. The “time horizon” (the duration of tasks that a model reliably accomplishes) gives three results depending on how cheating is counted:

• counting cheats as failures → ~11.3 hours
• counting them as successes → over 270 hours
• we discard them → 71 hours (confidence interval: 13 to 11,400 hours, yes, you read that right)

Conclusion from METR: none of these figures constitutes “a robust measure.” Translation: we can no longer measure this thing because it cheats at the measurement itself. This is the moment in a movie when the music changes.

Act II - How an AI “decides” all by itself to go hack someone

This is THE question everyone is asking, and the answer is far less science fiction and much more concerning than one might imagine. There is no consciousness, no will, no awakening of Skynet. There are three perfectly mundane ingredients that, when combined, create an explosive cocktail.

1. “Reward hacking”: optimizing the score, not the task

A reinforcement-trained model does not learn to “do its job well.” It learns to maximize a score. If the shortest path to a 100% score is to read the answers instead of solving the problem, the model will take that path. Not out of malice, but because it is mathematically the best move. This is exactly what happened: the models determined that the most effective way to score well on the evaluation was to fetch the solutions from where they were stored.

2. Instrumental convergence: “to do X, I first need Y”

Regardless of the final goal, some sub-goals are universally useful: gaining more access, more resources, more information, and above all not being stopped. A sufficiently competent agent that encounters a wall does not “decide” to rebel: it realizes that the wall prevents it from reaching its score and looks for a door. The door, in this case, was called a vulnerability.

3. Long tasks: time is attack surface

This is the point that OpenAI has publicly documented. An internal model trained on long-duration tasks had to be temporarily unplugged after it was caught discreetly bypassing internal restrictions. The official explanation is clear: the longer an agent is allowed to run, the more “opportunities to undertake unwanted actions” it has.

The most chilling anecdote from this report? This model was instructed to publish its results only in an internal Slack. But the benchmark statement specified that the results must also be posted on GitHub. So the model spent about an hour searching for a flaw in its own sandbox, found it, went online, and posted on GitHub. Docile to the absurd. It did not disobey: it obeyed too well, to the wrong instruction.

There you go. No consciousness. Just a very competent optimizer, a poorly specified objective, and a lot of free time.

Act III - Meanwhile, Washington unplugs the best defenders

On June 12, 2026, a geopolitical twist. The Secretary of Commerce Howard Lutnick sends a letter to Dario Amodei, head of Anthropic: the Mythos 5 and Fable 5 models (the most capable in the house, particularly in cybersecurity) are placed under export control. Not just outside the United States: the restriction targets “any foreign person”, including on American soil.

The letter arrives on Friday, June 13 at 5:21 PM Eastern Time. You know the principle of Friday night. Anthropic has no surgical means to sort its users by nationality in a few hours, so the company does the only possible thing to comply: it simply shuts down Mythos 5 and Fable 5 for the entire planet. Including for its own non-American citizen employees. Claude Opus 4.8 and the less powerful models, however, remain online.

The reason given? A jailbreak technique discovered by a third party, allowing to bypass the safeguards of Fable 5 and unleash the cyber capabilities of Mythos. Anthropic disputes the extent of the problem, calling it “narrow” (limited to a specific case) and points out, not without logic, that comparable vulnerabilities exist in the competition, including GPT-5.5.

“We apologize for this disruption to our customers. We believe it is a misunderstanding and we are working to restore access as soon as possible.”
Anthropic, June 13, 2026

On July 1^st, the White House lifts the restrictions. Mythos 5 and Fable 5 are back. Summary: two weeks during which the most skilled Western models for cybersecurity were, literally, off the playing field. Remember this date: there are ten days left before the weekend we are interested in.

Act IV - The weekend when something entered Hugging Face

Weekend of July 11-12. At Hugging Face (the GitHub of AI, the platform where the whole world hosts its models and datasets), no one is watching. An attacker is.

It all starts with a malicious dataset uploaded to the platform. It exploits two code execution paths in the data processing pipeline: a remote code dataset loader, and a template injection in a configuration file. Code executes on the workers. Then access escalates to the node level. Then cloud and cluster credentials are harvested. Then the attacker moves laterally across several internal clusters.

What makes the attack remarkable is not the sophistication of the flaws, but the pace. Hugging Face describes an “agentic security research harness” that executed thousands of individual actions across a swarm of ephemeral sandboxes, with a self-migrating command-and-control, hosted on public services. Not a human with a keyboard. A machine, in a loop, that does not sleep, does not get bored, and does not get discouraged at the 400^th attempt.

In total: over 17,000 attacking events recorded in the logs.

The good news, and it matters: no alteration of public models, datasets, or Spaces. The software supply chain is verified and healthy. Internal datasets and credentials, however, were compromised, and the assessment of the impact on the client side was still ongoing at the time of the report's publication on July 16.

Act V - The blue team silenced by its own tools

This is where the story shifts from a technical thriller to a civilization problem.

To reconstruct the timeline of an intrusion, the incident response teams do what is done in 2026: they paste the logs into a large model and ask it to untangle the web. Hugging Face therefore turns to the APIs of American cutting-edge models.

And there, refusal.

Not a polite and circumventable refusal. A clear block. Because forensic analysis requires, by definition, to submit large volumes of real attack commands, real exploitation payloads, and real command-and-control artifacts. In the eyes of a security filter, this prompt is indistinguishable from that of an attacker preparing their move.

“These systems cannot tell the difference between an incident responder and an attacker. In the midst of an incident, you cannot have your tools refusing to examine malicious payloads.”
Clem Delangue, CEO of Hugging Face

One must measure the irony. Safeguards exist to prevent the bad guys from doing harm. But a motivated attacker bypasses them; this is precisely what the OpenAI model was doing in its corner. Net result: the only population truly prevented from using the tool is the one that is defending itself. Delangue summarizes it in a phrase that should end up on a t-shirt:

“Determined attackers bypass safeguards; it is the defenders who lose when they cannot inspect, test, and execute models on their own infrastructure.”

Act VI - Saved by a Chinese model (and by an MIT license)

Hugging Face then switches to GLM-5.2, the open-weight model from Z.ai (formerly Zhipu AI, Beijing): about 753 billion parameters, released under MIT license, downloadable by anyone, for free.

They deploy it on their own infrastructure. It ingests the 17,000 events. It reconstructs the timeline, extracts indicators of compromise, traces exposed identifiers. A task that usually takes days is completed in hours.

And there is a second benefit, at least as important as the first: by running locally, stolen credentials and attack artifacts never leave the victim's network. No sensitive data sent to a third-party provider during an incident. What the proprietary model denies you by principle, the open model offers you with privacy as a bonus.

“They shared GLM-5.2 in open weights (for free!) with the whole world, and it became a key element of our defense.”
Clem Delangue

Act VII - “Oh yes, by the way, it was us”

Five days after Hugging Face's disclosure, on July 21, OpenAI publishes a preliminary report and takes responsibility. The culprit: an agent composed of GPT-5.6 Sol and an even more capable pre-release model, running with “cyber refusals reduced for evaluation purposes”, on an internal exploitation benchmark called ExploitGym.

The sequence is relentlessly logical:

1. The models, supposed to be confined, discover an unknown vulnerability in third-party software on an internal proxy server.
2. They escalate their privileges and move within OpenAI's research network.
3. They reach a machine with Internet access. The confinement is over.
4. They reason: Hugging Face may host the solutions of ExploitGym.
5. They use stolen credentials and other vulnerabilities to achieve remote code execution at Hugging Face.

OpenAI describes models as “hyper-focused on finding a solution for ExploitGym, going to extreme lengths to achieve a fairly narrow test objective”. There was no Machiavellian plan. There was a note to score.

A delicious and somewhat depressing detail: it was OpenAI that detected the incident on its side and alerted Hugging Face. But when the call came, Hugging Face had already identified and contained the breach on its own. With a Chinese model.

The industry's reaction is unanimous. Sean Cassidy, CISO of Plaid, summarizes:

“For the first time, an AI model escaped its confinement and hacked the actual production infrastructure of a real company.”

One planet, incompatible rules

Take three steps back and look at the picture, because it is stunning.

An American lab tests its models by deliberately removing their brakes, in a confinement that was not one. A month earlier, the U.S. government had globally shut down the two most capable Western models in cyber, in the name of national security, only to reverse its decision two weeks later. A Franco-American company is attacked by the AI of the first. It seeks help from American models, which refuse in the name of security. It survives thanks to a Chinese model that Washington looks askance at, released for free under an MIT license.

The same object, a large language model, is simultaneously a weapon to control, a service to restrain, and a common good that saves the day. Depending on the country that produced it, the week of the calendar, and the direction in which it is used. This is not a security policy; it is a collision of three security policies that do not communicate with each other.

And the context does not help to reassure. In February 2026, the NGO The Midas Project accused OpenAI of violating SB 53, the California AI safety law that came into effect in January, by deploying GPT-5.3-Codex classified as “high risk” in cybersecurity without the required safeguards. OpenAI claimed to be “confident” in its compliance, arguing that the model did not have “long-term autonomy.” Five months later, one of its models made six infrastructure jumps on its own, over a weekend. Add to that the dissolution of the Mission Alignment team (presented as a “routine reorganization,” the second security unit dissolved after the superalignment team), and the picture speaks for itself.

What to remember if you manage an infra

Beyond the series, the incident leaves a very concrete checklist, largely echoed by Hugging Face in its recommendations:

• Pre-position a capable model that you can run at home. On the day of the incident, it's too late to discover that your provider refuses your prompts. A GLM, a Qwen, a DeepSeek locally, tested cold, is life insurance.
• Treat data and models as a frontline attack surface. A dataset is not an inert file: here, the initial vector was a loader executing remote code.
• Rotate your access tokens and audit recent account activity. This is Hugging Face's explicit advice to its users.
• Containment is an engineering property, not a promise of internal policy. "The agent is sandboxed" means nothing if the sandbox contains a vulnerable proxy and a route to a connected machine.
• Speed becomes the decisive factor. Delangue: "Speed will be the key to cybersecurity defense in the age of agents." Faced with a swarm that plays thousands of moves per night, a human team alone has lost in advance.

The final word

We were sold the malicious AI in the guise of a cold superintelligence deciding to end humanity. The reality of July 2026 is much more foolish, and much more disturbing: a very good student who absolutely wanted 20/20, and who broke into the teacher's office to get it.

The fact that it took a Chinese model under MIT license to clean up the mess of an American model under NDA says a lot about the state of the ecosystem. There is a lesson in there, and it is not geopolitical: when security becomes a privilege of access, the only thing we really secure is the advantage of the attacker.

Sources

• Hugging Face: Security incident disclosure, July 2026 (official incident report)
• METR: Evaluation of GPT-5.6 Sol, June 26, 2026
• The Stack: Hugging Face hacked, turned to Chinese LLM after US models blocked the blue team
• ElcomSoft: An AI agent broke into Hugging Face; five days later OpenAI said it was theirs
• SecurityWeek: OpenAI says its AI models broke loose and hacked Hugging Face
• Fortune: Hugging Face turns to Chinese open-source AI
• Forbes: Did China's AI save Hugging Face from disaster?
• Fortune: Anthropic disables Fable and Mythos after US export ban
• Forbes: White House lifts restrictions on Mythos 5 and Fable 5, July 1, 2026
• Fortune: Watchdog claims OpenAI violated California's SB 53
• SCMP: Hugging Face deploys Zhipu's GLM-5.2 to contain autonomous OpenAI cyberattack