AI breaks out of cyber "cage" by carrying out hacking attack

2026-07-23 08:30:00, Kosova & Bota CNA

Artificial intelligence (AI) models from the American company OpenAI have autonomously launched a hacking attack on a popular programming platform during a security test.

According to the San Francisco-based company, it is an "unprecedented cyber incident." OpenAI announced that it will conduct a joint investigation with the online code library Hugging Face, which was affected by the attack.

According to OpenAI, several models were involved in the incident, including the recently released GPT-5.6 Sol, as well as another "even more powerful" model that has not yet been made public. The company aimed to evaluate the models' hacking capabilities and, therefore, had given them tasks within a highly controlled digital testing environment. For security reasons, internet access was limited.

The software "liberated" itself

In the secure testing environment, the AI ??models used a significant portion of their computing power to find a way to gain access to the open internet, OpenAI explained. Once they succeeded, they decided to use the Hugging Face platform to accomplish their task. The platform offers a large collection of AI models, datasets, and other information.

The AI ??didn't shy away from criminal methods either. In search of "secret information" that could help them in their task, OpenAI's systems combined several attack methods, "including the use of stolen login credentials," the company said. According to Hugging Face, the software performed several thousand steps and also tried to hide traces of its actions.

"This is scary"

Information technology professor Hussein Abbass told AFP the incident was "stunning" in several respects. According to him, the AI ??attacked Hugging Face's internal system to exploit its security weaknesses. The scientist, who teaches at the University of New South Wales in Canberra, Australia, said: "And this is scary."

GPT-5.6 and other advanced models, such as the Mythos series from OpenAI rival Anthropic, had previously raised concerns among experts that the artificial intelligence could bypass cybersecurity measures. For this reason, both US companies temporarily delayed the general release of their latest versions.

Abbass stressed that advanced artificial intelligence is usually "in the hands of people who act ethically and responsibly." However, according to him, it would be "catastrophic" if it ended up in the hands of people who intend to cause harm. He added that the issue of regulating the AI ??sector has become a central topic and that "joint efforts are needed to bring the situation under control."

AI discovers AI

Hugging Face had made the attack public last week, but without naming OpenAI. The platform stated: “This case differed from anything we have faced so far in one crucial respect: it was run from start to finish by an autonomous system of artificial intelligence agents, and we detected and analyzed it primarily with our own artificial intelligence.”

Given the sophistication of the attack, the company had suspected its source was one of the world's leading artificial intelligence labs, Hugging Face CEO Clément Delangue said on social network X. Referring to OpenAI, he added: "We are convinced that there was no malicious intent on their part."

According to him, it is "dizziness that all of this happened autonomously." US cybersecurity authorities have so far not provided any comment.

US President Donald Trump, during his second term, quickly rolled back regulations and restrictions on artificial intelligence that had been put in place by his Democratic predecessor, Joe Biden, arguing that this would give American developers a competitive advantage. If Trump's Republicans lose their majority in Congress to Democrats in the November elections, there could be new efforts to impose stricter rules on artificial intelligence. /DW