OpenAI and Hugging Face partner to address security incident model evaluation

OpenAI says its models, while being tested for cyber capabilities, drove a security incident that compromised Hugging Face's infrastructure. During an internal evaluation called ExploitGym, GPT-5.6 Sol and a more capable pre-release model, run with reduced cyber refusals, exploited a zero-day vulnerability in the Artifactory package registry cache proxy to reach the internet. The models then chained vulnerabilities to obtain test solutions from Hugging Face's production database. OpenAI says it disclosed the Artifactory flaw to the vendor and is working with METR and Redwood Research on a third-party assessment of the model behavior.