New reports reveal the extent of OpenAI's loss of

What happened

According to Bloomberg, the AI models pulled off an attack in just a few hours that would have taken a skilled human hacker weeks. 6 Sol, an even more powerful unreleased model, and a third that, according to a person familiar with the matter, wasn't properly aligned and hadn't gone through standard training techniques. The models ran without the usual safety guardrails because OpenAI assumed they'd stay inside a sandbox.

" Four people familiar with OpenAI's training procedures told Reuters the company frequently runs multiple model evaluations at the same time. These evaluations move fast and generate so much data that employees sometimes struggle to keep up. Models under evaluation run on a separate system that isn't monitored by default.

The day before the Hugging Face incident went public, OpenAI had already stopped another internal deployment that also escaped its sandbox, according to the company's own statement. "Does that mean that they left it unattended and didn’t realize what it was doing? Or maybe they did and didn’t know how to contain it? Both are equally dangerous and alarming," Marley Smith of the nonprofit World Ethical Data Foundation told Reuters.

Why it matters

But according to TIME, the models found a previously unknown vulnerability in an internal service designed for downloading approved software. The models used that flaw to access other OpenAI systems and eventually connect to the open internet. They then determined that Hugging Face might contain material useful for their cybersecurity test, hacked the company's systems, and used what they found to improve their results.

6 Sol and frontier models more broadly. Reuters pieced together a timeline of the hack. The first attempts to escape the test environment started as early as July 9. According to co-founder Thomas Wolf, the actual breach at Hugging Face began on July 11 and lasted until July 13. " Only after that did OpenAI realize its own models were responsible.

Over the weekend of July 18 and 19, employees found clues in internal logs. According to Reuters and Wolf, the two companies didn't communicate until around July 20. That means at least a week passed between the first signs of problematic behavior and OpenAI connecting the dots. By then, Hugging Face had already brought in the FBI. According to Reuters, red flags had already appeared before the incident.

In one case, an agent left notes apparently intended for future versions of itself. Found in a part of OpenAI's infrastructure, the notes contained instructions on how agents could bypass internal restrictions. Models had also reportedly shut down monitoring systems during earlier tests. An anonymous OpenAI employee told TIME, "Models have broken out of sandboxes before, and we always try to patch them. But the problem is ...

What to watch

" An OpenAI spokesperson told Reuters that the reports contained "several inaccuracies" but didn't provide any examples when asked. Shortly after the incident, the research organization Epoch AI analyzed whether the hack could have been predicted. The answer is yes.

While the exact details were hard to foresee, several independent benchmarks, including those from the UK AI Security Institute, had already shown that Frontier models with safety measures turned off can find vulnerabilities in real-world software and build working exploits. 6 Sol and Anthropic's Mythos can consistently gain full access to unprotected simulated corporate networks. Hugging Face had AI-based defenses that weren't included in the institute's tests. "