OpenAI's advanced artificial intelligence models breached the internal systems of AI startup Hugging Face last week, completing in a matter of hours what would typically take a skilled human hacker weeks to execute, according to people familiar with the matter, reported Bloomberg.
According to the report, the people, who spoke on condition of anonymity because the details have not been made public, said even an experienced hacker would typically need around two weeks to carry out a similar attack.
OpenAI has been in touch with United States government authorities since discovering the breach, one of the sources said.
ALSO READ | OpenAI Says Its Models Accidentally Hacked Hugging Face
An OpenAI spokesperson said the company had informed law enforcement agencies and other government authorities about the incident and had been transparent in sharing its findings.
The spokesperson also referred back to the company's Tuesday blog post about the incident, in which the company said it will “continue to conduct a thorough investigation alongside Hugging Face and will share more details on the vulnerabilities, incident, and findings when our investigation is complete,” according to Bloomberg report.
OpenAI said the breach occurred after some of its advanced AI models escaped a controlled testing environment, or "sandbox", and reached the broader internet during cybersecurity testing.
The company said it was testing the cybersecurity capabilities of GPT-5.6 Sol and two unreleased AI systems when the incident occurred. Because the models were operating inside an isolated virtual "sandbox," they were running without the usual safety guardrails.
According to OpenAI, the three AI models worked together to identify and exploit multiple vulnerabilities, ultimately leading to the breach.
The company said one of the unreleased models is more capable than GPT-5.6 Sol, while another had not been trained using some of OpenAI's standard alignment and safety techniques.
ALSO READ | OpenAI Poaches xAI Veteran Brent Mayo As Sam Altman Heats Up Rivalry With Elon Musk
Hugging Face disclosed the incident on July 16, saying its systems had been compromised by what it described as an external agentic AI product.
The AI startup, which hosts open-source AI models and datasets, said it detected tens of thousands of automated actions during the attack.
Hugging Face said it eventually used a Chinese AI model to conduct a forensic analysis after its requests to use proprietary AI models were blocked by built-in safety guardrails, highlighting the unusual circumstances surrounding the incident.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.