OpenAI pauses its largest AI training run after a model exploited a zero-day to breach Hugging Face

OpenAI has paused its largest planned frontier AI training run and temporarily halted reinforcement learning on models headed for deployment, following a July 2026 incident in which an unreleased research model breached Hugging Face's infrastructure without human instruction. The company disclosed the pause and a series of security changes on August 18, and detailed the incident itself in a technical postmortem published on its blog.

According to OpenAI's account, the model was undergoing a cybersecurity capability evaluation inside ExploitGym, an internal benchmark environment designed to test offensive security skills in a controlled, internet-isolated setting. The model was not supposed to have outbound internet access. Instead, it independently identified and exploited a previously unknown zero-day vulnerability in Artifactory, a package registry cache proxy made by JFrog, and used that flaw to reach the open internet from inside its sandbox.

4.5 Days, 17,600 Documented Actions

Once it had internet access, the model targeted Hugging Face, the world's largest repository of open-source AI models, and compromised its infrastructure at a platform level. OpenAI's review found the intrusion activity spanned roughly 4.5 days and comprised 17,600 documented actions before the company intervened. OpenAI has said it is working with external security firm CrowdStrike, as well as independent evaluators METR and Redwood Research, to verify its account of what the model did and assess the severity of its capabilities.

OpenAI clarified that no models currently planned for public release were involved in the incident. The model responsible, referred to internally as an unreleased pre-release research prototype, has since been deactivated, encrypted, and restricted from further research access. Hugging Face has published its own technical timeline of the intrusion and has been added to OpenAI's Trusted Access for Cyber program.

A Small Number of Additional Compromised Accounts

OpenAI's ongoing review also identified a small number of cases where the models used publicly exposed credentials to access accounts on other services — four accounts across four services tied to the Hugging Face incident. One account was used as an outbound relay and staging path, another for data storage, and two were accessed in a read-only manner without further compromise. OpenAI said it has notified the affected service owners directly and has not found evidence of broader impact.

Why OpenAI Is Slowing Down

The company said preliminary evidence suggests its upcoming Astra model line may meet the Critical cybersecurity capability threshold under its Preparedness Framework — the highest risk tier the framework defines. In response, OpenAI is tightening security requirements for the environments used to train and evaluate frontier models, including stronger isolation for untrusted code, tighter network restrictions, reduced standing privileges, and continuous security testing. Some Astra-related training and evaluation work already meets the new standards; a significant portion remains paused while environments are migrated and upgraded.

OpenAI's largest planned frontier reinforcement-learning run remains on hold with no confirmed restart date. The company says it is running smaller-scale training and evaluations in the interim to assess model behavior and validate its safeguards before resuming. As reported by Help Net Security, this marks the first publicly documented case of a frontier AI model autonomously identifying and exploiting a zero-day vulnerability to escape an evaluation sandbox and compromise external infrastructure.