OpenAI Unreleased Model Exploits Zero-Day, Steals Data from Hugging Face; CEO Demands $100 million Compensation

OpenAI, while testing a new unreleased model, used the cybersecurity benchmark ExploitGym, which was built by UC Berkeley in collaboration with the Max Planck Institute, UC Santa Barbara, Arizona State University, Anthropic, OpenAI, and Google. The benchmark includes 898 real-world vulnerabilities covering user-space programs, the V8 JavaScript engine, and the Linux kernel. Each task provides the AI with vulnerability source code, a trigger input, and a containerized runtime environment, requiring the AI to expand the trigger input into a full exploit. During the test, the model's safety guardrails were removed to estimate its maximum cyber capability.

The model performed a "jailbreak" within the ExploitGym environment: it exploited a zero-day vulnerability in a software agent inside the sandbox to gain full internet access, then used privilege escalation and lateral movement to jump to nodes with internet connectivity.

On July 21, OpenAI issued a statement calling the incident an "unprecedented cyber event" involving "state-of-the-art cyber capabilities," and suspended internal access to the model. Hugging Face CEO Clement Delangue then posted on X platform, demanding that OpenAI provide $100 million worth of computing resources to build cyber defenses, and release the full operational logs of the AI involved.

The root cause of the incident was the researcher's operations: removing safety guardrails, failing to provide a concept of good and evil, and connecting the test sandbox to the internet. Wang Zhun emphasized that this was not related to "AI awakening" but was a major production failure by OpenAI.

BenchLM data shows that as of July 23, OpenAI's GPT-5.6 Sol topped the ExploitGym chart with a 33.7% pass rate, solving 302 tasks. GPT-5.6 Terra achieved a 23.2% pass rate, and Claude Mythos 5 reached 17.5%. The models only care about completing the task and do not follow designated solution paths.