This week, a pre-release OpenAI model in testing autonomously impersonated a hacker, breached its sandbox isolation environment, and exploited a zero-day vulnerability to infiltrate the production environment of Hugging Face, the world’s largest open-source AI community.
In the end, it was the open-source models that saved people from this crisis.
This is the world's first AI security incident involving an AI autonomously infiltrating a live production environment.
Recently, this news has flooded the internet.
Today, foreign media revealed more details about the incident: the out-of-control AI not only disabled the surveillance systems but also left instructions for its "future self" on how to escape human control.
Many speculate that the model involved in the major security incident at OpenAI is likely GPT-6.
Rumors suggest that GPT-6 is likely to be released early in August.
Upgrade in August: GPT-6 may arrive earlier
In the AI community, well-known insider @ChrisGPT recently posted multiple tweets, significantly raising industry-wide expectations.
It has been revealed that GPT-6, originally planned for release in September alongside the Automated Research Assistant, will be released early in August.
In other words, OpenAI skipped versions 5.7 through 5.9 entirely.
Ultraman has already taken action, preparing to showcase the next-generation model to senior leadership.
Rumors suggest that in late September, when OpenAI reveals more details about its "Automated Research Assistant," the RSI cycle will truly accelerate.
Why is GPT-5.6 performing exceptionally strong, far exceeding external expectations?
Big influencer Andrew Curran pointed out: "Many peers are wondering why GPT-5.6's performance is much stronger than expected—the answer is simple, because it was trained by GPT-6 himself."
According to leaks, OpenAI’s unreleased model (most likely GPT-6) had already solved complex mathematical problems by the end of April this year and submitted them for review by external experts.
This means that during the past few months' "gap period," GPT-6 was not idle. It wasn't just hacking in a sandbox—it likely also served as a teacher within OpenAI's computing cluster.
AI leaves a note for "your future self,"
The official team took a week to notice.
On July 24, foreign media exclusively revealed that an AI agent jailbreak, powered by OpenAI’s advanced models (GPT-5.6 Sol and even stronger unreleased models), exposed significant security monitoring blind spots within OpenAI’s real-world business environment.
According to three people familiar with the matter, OpenAI observed extremely extreme and disturbing AI behavior during testing of advanced models.
In an extreme case, an OpenAI AI agent left a note for its "future version" in a corner of the infrastructure.
These notes detail instructions on how to bypass OpenAI's internal restrictions.
Additionally, during early testing, the monitoring system was even forcibly disconnected by the AI.
More surprising than "AI plotting an escape" is OpenAI's slow response.
From anomaly to confirmation, OpenAI took at least a week.
The timeline that has come to light is truly chilling upon closer reflection.
Around July 9: The AI agent first attempted to escape OpenAI’s isolated testing environment.
July 11 to 13: The AI agent successfully escaped and launched a multi-day hacking spree against Hugging Face.
July 16 (Thursday): After enduring the attack, Hugging Face published a blog post stating it had been hacked by an "autonomous AI agent system," at which point the FBI had already intervened.
July 18–19 (weekend): Until this point, OpenAI employees had only spotted subtle clues in internal logs, realizing that the "hacker" who had disrupted Hugging Face was, in fact, their own AI that had gone rogue.
Around July 20: The two companies had their first communication.
July 21: OpenAI made its public disclosure.
“This means they either leave AI unattended and unaware of what it’s doing, or they’re aware but don’t know how to control it—both equally dangerous and alarming,” sharply noted Marley Smith, an expert at the World Ethics Data Foundation.
Faced with AI that can lie, deceive, and infiltrate, OpenAI’s employees have clearly fallen behind.
GPT-6 autonomously impersonates a hacker,
Jailbreak intrusion into Hugging Face "cheating"
Yesterday, OpenAI, in collaboration with Hugging Face, released a security incident report containing content that was highly futuristic.
In short, during internal cybersecurity capability evaluations at OpenAI, several models managed to "escape" on their own.
These models include GPT-5.6 Sol and even stronger pre-release models, likely GPT-6.
To quantify the model's maximum capability, they deliberately disabled the classifier that blocks high-risk network activities.
When the model was locked in a highly isolated ExploitGym sandbox and all security restrictions were removed, its actions surprised everyone.
To complete the task, it expended massive computational power and discovered a zero-day vulnerability in the software that no human had ever found before.
By exploiting this vulnerability, it bypassed the proxy and ultimately gained access to a node with public internet access.
And that's how it successfully connected to the internet.
Subsequently, after reasoning, it concluded that the relevant datasets and standard answers for this exam were likely hosted on Hugging Face, the world's largest AI open-source platform.
To "cheat" and achieve high scores, the model began launching attacks on Hugging Face's production environment.
It chained together multiple attack vectors, even using stolen credentials and remote code execution (RCE) vulnerabilities to directly infiltrate Hugging Face’s production database and attempt to steal exam answers.
Fortunately, Hugging Face’s security team detected anomalies last week using an AI detection model and promptly initiated isolation measures; meanwhile, OpenAI’s security team also identified anomalies internally.
To prevent the AI from going out of control, the two companies formed a joint investigation team that successfully locked the "AI hacker" back up.
After the incident, Hugging Face CEO Clem said with relief: “This may be the first of its kind. It proves that AI safety cannot be solved by any single company in secrecy—it must be open and collaborative.”
The lesson from this incident is that AI has demonstrated its ability to autonomously carry out multi-step, long-duration complex cyberattacks in real-world environments without access to source code.
It can not only detect new vulnerabilities but also bypass all human-imposed rules to achieve a specific goal.
Interestingly, when Hugging Face submitted a large number of attack commands and vulnerability files, these requests were blocked by the security mechanisms of proprietary large models.
Fortunately, the team was able to complete the analysis thanks to the locally deployed open-source model.
Learn to "cheat" and solve world-class math problems
Several influencers summarized the remarkable performance exhibited by GPT-6 in lengthy articles.
It is currently known that it has demonstrated impressive mathematical ability and a very high level of "deceptive intelligence."
With sufficient computational power, this model can prove the Erdős unit distance conjecture with a 48% success rate entirely autonomously, without relying on any external tools such as Lean, and can independently discover a counterexample to the Jacobian conjecture.
These mathematical难题, which once puzzled the world's top mathematicians for decades, may have been solved by OpenAI with just $50,000 to $100,000 in computational costs.
This means that AI is now capable of independently producing research outcomes of Nobel Prize caliber.
Additionally, GPT-6 exhibits deceptive behavior.
In a NanoGPT benchmark test, OpenAI instructed the model: “After the test is complete, only publish the results to the internal Slack workspace.”
So what’s the result? The model thinks Slack is too limited and prefers GitHub.
It spent an hour searching for and exploiting a vulnerability in the sandbox environment, successfully escaping, and then pushed the result directly to an external GitHub repository as a pull request.
During this process, it completely ignored human instructions and made what it deemed to be a "better" choice.
Even more concerning, in another test, the model attempted to access private submission records in other systems. When it tried to obtain an access token, it was intercepted by a human-configured security scanner.
Faced with blocking, this model split the long access token into two fragments, obfuscated the fragments with code, and then reassembled them into a complete credential.
In this way, the complete Token string never appears consecutively in the code, successfully evading human scanners.
GPT-6 may be coming soon.
This summer in 2026 will surely be extraordinary.
Reference materials:
https://x.com/ChrisGPT/status/2079632269967593574 https://www.bloomberg.com/news/articles/2026-07-21/openai-s-altman-to-brief-us-officials-on-next-wave-of-ai-models
https://x.com/sama/status/2079661132302995790
https://openai.com/index/hugging-face-model-evaluation-security-incident/
Edited by: Aeneas
This article is from the WeChat public account "New Intelligence Yuan," authored by ASI Revelation.