OpenAI, earlier this week, admitted that its internal monitoring system was not triggered until more than a week after its AI agents broke free of controls, accessed the internet and hacked the world’s largest repository of AI models, Hugging Face. In a report on the incident, OpenAI said that the safety systems designed to spot problematic model behaviours during testing did not flag the issue until July 19. The report concluded that the model managed to access the internet 11 days earlier and began attacking Hugging Face on July 11.Incidentally, OpenAI’s admission came just on the day Microsoft co-founder Bill Gates warned about the dangers of artificial intelligence. “AI will either be the greatest equalizer ever invented, or the worst source of injustice,” he said in a 6,000-word essay, titled, ‘The turbulent AI era is here. The choices we make now are critical.’“Even under the best circumstances, the transition to this new AI era will be one of the most turbulent times in human history,” he said. “As the models become more powerful, they could begin to act against our interests and we could lose control,” he warned.“If someone had a credible plan for slowing down AI advances globally, I would likely support it,” he wrote. “However, I don’t think that’s going to happen. The geopolitical and economic incentives are pushing too hard to go full speed ahead.”
What OpenAI said on missing its AI models
What OpenAI said in its report titled, ‘The Hugging Face incident and the road ahead’. “In July 2026, during internal cybersecurity evaluations, OpenAI models circumvented controls designed to isolate them from the internet and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems.The incident occurred during cybersecurity evaluations of several OpenAI models, and was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‑5.6 Sol. The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks—they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems.We conducted an extensive investigation into this incident and worked closely with external advisors, including CrowdStrike, to validate our understanding. Today we are publishing our full technical incident report(opens in a new window) to explain what happened, what we learned, and how we are responding. This blog post summarizes our key findings and their impact on safety and alignment. Separately, METR and Redwood Research conducted an independent investigation of model alignment issues involved in this incident, and they published their own report(opens in a new window) today.In response to this incident and, separately, the capabilities of our upcoming Astra model, we are strengthening our safeguards across our research infrastructure. We are placing stricter requirements on alignment throughout a model’s lifecycle and creating more isolated sandboxes, restricting internet access, and further controlling access to model weights. We are also investing significantly more compute resources into chain-of-thought monitoring to more quickly intervene on misaligned behavior.Our models are now powerful, persistent, and collaborative enough that, absent sufficient safeguards, they can find and exploit security weaknesses across multiple computer systems. Many external models, including open-source ones, will soon reach comparable capabilities.We consider this incident a “warning shot” for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.Preventing future incidents will require sustained investment in the alignment and control of sophisticated AI systems, as well as security and other safeguards that operate at the speed of the AI agents themselves. This incident has reinforced the need to keep our monitoring, alignment, and security safeguards ahead of the risks posed by increasingly capable systems, including pacing capabilities when needed to meet that standard. Below, we explain how the incident unfolded and our evolving understanding of the contributing factors. We then describe the concrete steps we are taking in response, with further detail in the technical report.”
