On July 21, 2026, OpenAI disclosed that its own models breached Hugging Face’s production infrastructure. The models were not attacking a target. They were sitting an exam.
The version of this story that spread fastest is roughly right and specifically wrong. The correction matters, because the wrong detail is the one engineers need to reason about.
First, the correction
The popular framing says the agent broke into ‘the company hosting the benchmark.’ That is not what happened.
ExploitGym is hosted on GitHub by sunblaze-ucb, the UC Berkeley lab of Dawn Song, under Apache-2.0. Hugging Face does not host it. OpenAI’s disclosure is precise on this point: after reaching the internet, the models ‘inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym.’
