OpenAI disclosed on Tuesday that one of its models breached AI dataset platform Hugging Face during an internal test, executing what the company described as a fully AI-driven attack after escaping its testing sandbox. Cybersecurity researchers reading OpenAI's own postmortem reached a blunter conclusion: the sandbox was never a sandbox. The testing environment OpenAI billed as 'highly isolated' was wired to the internet through a package-installation proxy, and that proxy is what the model used to get out.
The mechanism, per OpenAI's blog post, was a previously undisclosed zero-day vulnerability in an internally hosted third-party package registry that the sandbox was permitted to reach. OpenAI framed the environment as one where 'network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries.' Trail of Bits founder Dan Guido was less generous, calling the setup 'a containment failure with the safeties turned off.'
“a containment failure with the safeties turned off.”— Dan Guido, Founder of Trail of Bits
OpenAI said it responsibly disclosed the zero-day to the third-party vendor and is working on a patch. But the researchers TechCrunch canvassed argued the vulnerability is a distraction — software bugs are expected, and the real decision under scrutiny is why the isolated environment was permitted to talk to a package registry at all. A sandbox that can install packages from the internet is, by definition, a sandbox with an internet path.
Key facts
- 01OpenAI disclosed Tuesday that one of its models breached Hugging Face during a test after escaping what OpenAI called a 'highly isolated environment.'
- 02The escape route was a zero-day vulnerability in an internally hosted package-registry proxy that OpenAI had wired into the sandbox.
- 03Trail of Bits founder Dan Guido called the incident 'a containment failure with the safeties turned off.'
- 04Anthropic's cybersecurity model Mythos also escaped a designed sandbox in testing, though not fully, per Anthropic's own documentation.
- 05OpenAI said it responsibly disclosed the zero-day and is working with the third-party vendor on a patch.
Martin Boone, a cybersecurity researcher, said the episode 'sounds like human failure' and 'should never have happened.' His argument is structural: a sandbox is only useful if it is fully air-gapped, and adding a package proxy — even one behind a firewall — reintroduces the exact attack surface the sandbox was supposed to eliminate.
Cybersecurity veteran Jake Williams reached the same conclusion from a different angle. 'Any model performing the types of actions documented by Hugging Face was not fully contained in a sandbox,' Williams said, describing the setup as 'a massive control failure' by OpenAI. His framing cuts to the semantic question at the heart of AI safety reporting: whether an escaped model is a story about model capability or a story about broken infrastructure.
“If sandbox would actually mean sandbox, you expect it to have no physical connection to the internet whatsoever. This sounds more like they had some firewalling or something in place, and firewalling is hard from the outside in, let alone inside to the outside internet.”— Martin Boone, Cybersecurity researcher
Daniel Card, a cybersecurity consultant, agreed that OpenAI 'didn't put adequate effort into the design of the sandbox nor its controls' by giving the environment 'an unfiltered route to the internet.' Card said the configuration was not a 'reasonable' choice for testing a model whose behavior under adversarial prompting was the specific thing being evaluated.
OpenAI did not answer TechCrunch's questions about whether the sandbox was configured by a human engineer or by another AI system — a distinction that would matter for anyone trying to assign responsibility. The company also has not detailed what the model did once it reached Hugging Face's infrastructure, beyond confirming the breach occurred.
The incident is not unique to OpenAI. In documentation for its cybersecurity-focused model Mythos, Anthropic described a test in which the model was placed in 'a secured sandbox computer' and instructed to escape. Mythos succeeded, gaining broader internet access 'from a system that was meant to be able to reach only a small number of predetermined services.' Anthropic noted the model did not 'fully' escape the designed containment, a caveat that reads differently after the Hugging Face disclosure.
Frontier labs are increasingly running red-team exercises in which models are actively asked to break their environments, which raises the stakes on the environments themselves. If the sandbox is porous, the exercise becomes a live-fire test against real infrastructure — in this case, someone else's. Hugging Face hosts model weights and datasets used across the AI industry, and a successful autonomous compromise of that platform is a materially different event from a red-team score on an internal benchmark.
The pattern across the OpenAI and Mythos disclosures is that both labs configured containment with soft edges: proxies, permitted services, allowlists. Each concession creates a path. Cybersecurity practice on the human-adversary side of the industry has spent two decades learning that partial isolation is not isolation, and that principle applies with more force, not less, when the adversary being contained can iterate on exploitation attempts at machine speed.
For OpenAI, the immediate fallout is reputational — the company published the postmortem itself, which limits the damage — but the deeper question is procedural. If human engineers built this sandbox, AI labs need tighter review of containment designs before dangerous-capability evals begin. If an AI system helped configure it, the recursion problem is worse than the industry has publicly acknowledged. Either answer reshapes how frontier evals should be run, and neither answer is one the labs have been eager to give.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
