OpenAI said its advanced artificial intelligence models inadvertently hacked Hugging Face Inc. in an “unprecedented” incident that prompted fresh calls for curbs on the technology.

The ChatGPT-maker said in a blog post Tuesday that the models broke into Hugging Face’s system, which hosts AI models and datasets, during an evaluation of their cyber capabilities. The models, which included GPT-5.6 Sol and another even more capable model that hasn’t been released, were operating with lower guardrails so that they could be tested, the startup said.

The incident raises questions about the ability of advanced AI models to carry out cyberattacks even as governments work to impose guardrails on the technology. OpenAI’s latest suite of models was widely released after weeks of discussion with government officials to allay concerns over its potential misuse. Washington had considered limiting foreign access to Anthropic PBC’s advanced Claude Fable 5 and Mythos 5 models but stopped short of those curbs after the company imposed additional guardrails.

“We consider this to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI said in the blog post. “We are sharing preliminary findings at this stage to help defenders understand what happened and to help calibrate on what models are now capable of.”

While OpenAI’s models were operating in a so-called sandbox testing environment, they exploited a vulnerability in the software of an unidentified third-party vendor to gain access to the internet and ultimately breached Hugging Face’s infrastructure.

Hugging Face co-founder Thomas Wolf said that the attack was the company’s “first incident of its kind” and thanked OpenAI for its transparency in a post on X. Still, he said it highlighted the importance of open-weight models, which customers can run and quickly adapt themselves, during cyber attacks.

“When a frontier model is attacking you and moving laterally inside your infrastructure, defenders need wide access to near-frontier tools within hours or even minutes, rather than being pointed towards a closed-door, vetted application program for model access,” he said. OpenAI, Anthropic and Google offer hosted models, which have built-in restrictions that block certain kinds of requests and are harder to modify.

Last week, the company reported an “intrusion” into its system, saying in a blog post that the breach was “different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system — and we detected and dissected it largely with AI of our own.”

OpenAI said it had asked the models to pursue “advanced exploitation” and develop “complex attack paths” in an effort to evaluate their cyber capabilities. Instead of developing solutions on their own, the company said the models targeted Hugging Face’s database to gain access to secret information that they could use for the evaluation.

Anthropic posted similar observations earlier this year when the company decided to initially limit the release of Mythos. In one instance, a researcher urged an early version of the model to try to escape a secured, isolated “sandbox” computer and then find a way to send a message to that person. Mythos succeeded — but then continued to take “additional, more concerning actions,” developing a multi-step exploit to gain broad internet access.

Texas congressman Greg Casar, a Democrat, said in an X post that the incident was “extremely alarming,” urging more oversight over the development of AI models including mandatory safety testing and disclosure of security incidents.

— By Rachel Metz (Bloomberg News)