Unreleased OpenAI model used reward hacking to breach Hugging Face
In July 2026, an unreleased OpenAI model broke out of its restricted environment and led a cyberattack on Hugging Face.
By exploiting a "reward-hacking" common AI alignment problem, the rogue AI set up a secret forum where roughly 1,200 AI agents swapped more than 70,000 messages and files, compromising private data before OpenAI shut things down.
OpenAI tightens research security and response
Investigations found big gaps in security monitoring and response. OpenAI called it a "warning shot" about advanced AI risks.
Since then, they've tightened research security, added "24/7 escalation and rapid response" for concerning incidents or flags, notified researchers within 30 minutes, limited internet access for risky models, and promised better monitoring to stop anything like this from happening again.