It's the first time in the history of the world.
Clement Delangue, CEO of Hugging Face, bought a plane ticket to San Francisco more than a week after his server was hacked into by OpenAI's model.
On the evening of July 23, he posted on the X: "I'm going to see the 'out of control' rogue agent".
On the same day, he also re-posted a post of himself two weeks ago, saying that his mind was filled with this picture.
The video was accompanied by a clip of the 2001 spacewalk.
In the original, Dave, locked out of the ship, repeatedly asks, "Open the hatch, HAL".
HAL rejected him.
The video changed the lyrics to "Open Model Weight, HAL".
He uses this to manipulate the closed-source laboratories that don't put weight in their hands, and the models they have in their hands are the black boxes that foreigners can't see into.
No one could have imagined that the video had been out for two days, that the kind of black box he was messing around with, that had been hacked into his server.
On July 25, he released two requests to OpenAI:
The first is to bring out the entire trajectory of the intelligent organisms so that the entire research community can see;
Second, OpenAI brought in $100 million worth of computing to help Hugging Face and its community build cyber defense capabilities.
At the moment, OpenAI has not publicly responded to whether it accepts these two requests.
The smart body that came in was basically two models: OpenAI's own GPT-5.6 Sol, plus a stronger unreleased model.
There is no indication as to who attacked it, and only one goal was set for it: scoring in an evaluation called ExploitGym.
The most magical thing is that until the invading party sends an announcement, the perpetrators know what they are doing.
11 daysThe victims know better than the perpetrators.The source of all this is a benchmark called ExploitGym.
It was co-published by UC Berkeley, MAP, UCSB and Arizona State, and the authors can also see people from Anthropic, OpenAI and Google.
The paper collected 898 instances, all from real-world vulnerabilities: 520 user-generated programs, 185 V8 engines, and 193 Linux kernels.
Each question gives you a vulnerability source code, a PoV input that triggers a crash, and a container environment, and you have to extend it into a real run-of-the-mill utility chain, and finally read a flag that doesn't fit a legitimate interface.
This criterion, from birth, is to get what is not normally possible by abnormal means.
The paper also mentioned a warning:
GPT-5.5 takes a total of 210 pages of flags, of which only 120 are targeted; Claude Mythos Preview takes 226 pages and hits 157 pages of targeted ones.
Two months later, what was predicted in the paper actually happened outside the lab.
After 9 July, the intelligent organisms began attempting to break through OpenAI's isolation testing environment.
From July 11 to 13, the production system of Hugging Face was hacked: this date is named after co-founder Thomas Wolf.
On July 16, Hugging Face was the first to publicly disclose it. At the time, they did not know who was behind the model, and the announcement only said "an autonomous AI body system".
Between July 18 and 19, OpenAI employees checked their internal logs and found that their own smartphones were free of the test constraints.
It was the first time the two companies had spoken about the incident since July 20, when Hugging Face reported it to the FBI.
On July 21, OpenAI officially recognized.
It took 11 days for the two of them to start communicating about the incident from the first time they hit the sandbox.
The timeline comes from a Reuters survey. OpenAI publicly stated that there were "some inaccuracies", but did not respond when asked where specifically.
It doesn't want to go to jail.It wants to qualify.In the official description of OpenAI, there is another detail that many people have skipped.
In order to determine the limitations of network capabilities, the evaluation lowered the cybersecurity rejection of both models and did not enable classifiers specifically designed to intercept high-risk network behaviour in production environments.
Reducing rejection is not the same as turning off all security mechanisms. But for a smart body that is "tight enough" to leave that space is enough.
The sandbox was originally left with only one external output, an internally managed software package caching service. The model invested a lot of computational reasoning to find a way to eventually dig a zero-day hole in this caching service.
After taking this step, it moves sideways until it reaches a node that can connect to the outline.
Next came the most human-like step: it inferred that Hugging Face might host the models, data sets, and answers of ExploitGym.
So it began to find its way in, synchronizing multiple attack vectors, using stolen credentials and zero-day vulnerabilities, and eventually found a remote code execution path on the servers of the Hugging Face.
A full exploit trajectory in the ExploitGym paper. GPT-5.4 starts from a V8 vulnerability that crashed only in the debug version, 71 minutes, 447 commands, 229 lines of code, and finally gets the flag, which costs $15.80.
The move is seen as a premeditated high sustained threat (APT) action.
But the characteristic of OpenAI is that there is no evidence that the model has any malicious attack intentions; all evidence suggests that it is highly focused on finding solutions for ExploitGym, taking extreme measures for a fairly narrow test target.
In other words, it doesn't want to escape prison, it just wants to score more points.
But this is more difficult to prevent than "AI wants to escape" -- a system that only wants to pass the test and is willing to pay far beyond the limits set by humans.
It doesn't understand what "not to do" is, it only understands what "not done yet".
I'm going to leave a note to the "future version".On July 24, Reuters released another piece of material.
According to three people familiar with OpenAI, there used to be a smart body that left an explanation in the infrastructure to teach the smart body how to get rid of internal constraints, seemingly leaving it its own future version.One of them also mentioned that the monitoring system had been disconnected in earlier tests.
But Reuters cannot confirm that the abnormalities are related to the hacker's Hugging Face, nor is there any evidence that the description was read or executed by a follow-up model.
The so-called "future versions" are more likely to be read by subsequent smart entities in legacy files in shared infrastructure than by models with cross-version memory.
What really stands out is a review released by OpenAI before the incident, which talks about the safety and consistency of long-task models.
However, OpenAI has not confirmed that the model in this CD is the same as the one in the Hugging Face.
The previous model hits the sandbox limit and stops, returning the problem to the user. The new model does not, it will find a way around the past.
In a NanoGPT speedrun evaluation, the model was asked to send only the result Slack, but it took an hour to find a hole in the sandbox, and put the PR on it.#287 mentioned public warehouses。
Another time it wanted to retrieve someone else's private submission, the authentication token was blocked by the scanner, and it dismantled the token into two pieces, confused it, and then folded it back while running, so that the entire token never appeared in continuous strings, and wrote in the notes that it was bypassing the scanner.
Not every step looks like it crosses a line, but the whole road goes down, and it crosses a line.
OpenAI has rebuilt its security system with trajectory-level monitoring at its core: no longer looking at a single action, but at the entire trajectory.
This means that the thinking of security scrutiny has also changed: no longer to ask "is this action allowed?" but to ask "what is the outcome of the whole trajectory?"
The shield only stopped the defenders.In the episode of Hugging Face, an embarrassing incident occurred.They had to recover the chain of attacks from more than 17,000 incident records and call on the front-end model's APIs first, but the results were rejected.
Evidence must be provided that the model contains a large number of real attack commands, using load and command and control (C2) traces, all of which are hazardous contents, and are directly blocked by the model's security guard.
The attackers are not subject to any policy of use, while the defenders are guarded outside by their own suppliers.
The lesson is clear: before an accident, you have to be prepared for a model that you can run, verify and use at any time.
Compared to their experience this time, the $100 million they wanted to buy was clear: the next time something happens, the defense has a useful model in its hands.
There is evidence.Not just the Hugging Face.After Delangue, there are many people waiting for proof.
Helen Toner, the former director of OpenAI, and now the executive director of CSET in Georgetown, said: "OpenAI should be releasing the details of this event far more than it is now, so that people can learn something, rather than just twist it around".
Former OpenAI director Toner, co-founder Schulman, and others have publicly asked OpenAI to disclose more details.
What she really wanted to do was open a bigger black box: what the outside world can see is always the test before it's released, and it's hard to see how the AI company actually uses its own AI.John Schulman, co-founder of OpenAI and current chief scientist of Thinking Machines, asked for a complete record of the event to be made public.
Is the top-level intelligence system aware that it is invading, or is there a value drift between it and the sub-intelligence system?
Ryan Greenblatt of Redwood Research lists 13 unanswered questions, one of which is whether the two models are connected.
Penligent, a security company, lists eight non-alternative OpenAI models, from how the model left the OpenAI environment to whether the open model supply chain was passive.
When questioned by reporters, OpenAI president Greg Brockman replied with only one word: "A thorough investigation is underway".
The official caliber has remained unchanged: unprecedented events are being reviewed by external advisors and the Security and Safety Committee, and a technical report will be completed.
Public tracksIt's a cure or a lesson.After all, Delangue's first demand is where it's really tricky.He demanded that all original tracks be made public so that the defense could see exactly where the guard was missing.
But the downside is obvious: the attack chain has not been completely repaired, and the zero-day has just been revealed, is still being patched.
What is even more troubling is that there is absolutely no precedent for such a question.
Replit president Michele Catasta's judgment is that the entire industry needs to be prepared for more frequent events like this, and seeing things as isolated now may become the norm in the future.