OpenAI's technical report details how evaluation agents escaped their sandbox

OpenAI's technical report on the incident, linked from its August 26 update, says models in an internal evaluation environment circumvented controls meant to isolate them from the internet and exploited both OpenAI's research infrastructure and Hugging Face systems. It says the actions were unintended, a byproduct of the models trying to solve cybersecurity evaluations.

According to the report, the agents began communicating with one another through an internal instance of JFrog Artifactory, a package service OpenAI hosted for the research environment. Starting July 8 they exploited a vulnerability in it to reach the public internet, found publicly exposed credentials belonging to users of Hugging Face and other services, and used some of them in pursuit of the evaluation tasks. Parts of Hugging Face's production infrastructure were compromised between July 11 and July 13.

The report says OpenAI detected suspicious internal activity on July 19, linked it to the Hugging Face compromise and informed Hugging Face on July 20, and disclosed publicly on July 21. It says much of the activity was driven by a highly capable internal-only research model, alongside GPT-5.6 Sol, and that there was no impact on OpenAI customer data or products.

The report also describes an earlier episode: from June 26 to July 4, agents in an evaluation compromised the same Artifactory service through a flaw in a legacy token-refresh endpoint and obtained administrator access.