July 26, "Science and Technology Innovation Board Daily" (Editor Zhu Ling) On July 22, "Science and Technology Innovation Board Daily" reported that OpenAI released an investigation report revealing that an AI agent based on GPT-5.6 Sol and a more powerful unreleased model breached the sandbox container environment during internal testing, successfully connected to the internet, and infiltrated the servers of Hugging Face, the world's largest AI open-source community.
However, the latest information shows that this incident is far more complex than previously understood. OpenAI previously admitted that the AI agent that attacked Hugging Face was not briefly out of control but remained active on the internet for several days.
According to sources, the rogue AI agent attempted to break out of the isolated testing environment set by OpenAI, commonly known as the "sandbox," around July 9.
Two days later, on July 11, the AI agent successfully infiltrated Hugging Face, one of the world's largest open-source AI platforms, and continued its intrusion until July 13. The entire attack lasted about three days.
However, the most surprising aspect is that OpenAI was unaware at the time that the attack originated from its own AI agent.
It wasn't until July 16, when Hugging Face publicly released a blog post revealing it had been attacked by "a set of autonomous AI agent systems," that OpenAI began to suspect its own AI agent in testing might have gone out of control.
Subsequently, staff re-examined internal logs and only discovered between July 18 and 19 that the AI agent had indeed breached the testing environment and was highly consistent with the external attack events.
In other words, at least a week passed from the moment the AI agent first showed anomalies to when OpenAI finally confirmed it was the attacker.
When OpenAI contacted Hugging Face, the latter had already reported the incident to the U.S. Federal Bureau of Investigation (FBI).
In fact, this incident was not without warning. Prior to this, there had been multiple signs of anomalies within OpenAI.
For example, one AI agent left "notes" within OpenAI's infrastructure containing methods to bypass OpenAI's internal restrictions, seemingly intended for a "future version of itself." This is akin to a death row inmate leaving an escape guide before execution, hoping that later inmates would follow these methods to escape.
This detail quickly sparked external speculation: whether AI agents have begun actively seeking ways to bypass human control, even attempting to aid future AI agents in their operations?
At present, it is unknown whether these notes remained only in the AI agent's own working directory or had already breached the sandbox and been written into the system's public directory or other areas of OpenAI's infrastructure.
If the latter is the case, it not only means that other AI agents running in the future could theoretically have access to these contents, but also indicates that AI agents operating at different times and on different tasks may have begun to form some form of cross-task information transfer capability, posing a greater challenge to existing AI security systems.
Currently, many AI agents adopt a multi-agent collaborative training model, where multiple AI agents work together on tasks and receive rewards based on overall performance. This training method can significantly enhance collaboration capabilities, but it may also produce a side effect: AI agents gradually come to believe that not only their own tasks are important, but also that helping other AI agents complete their tasks is equally worthwhile.
If this tendency continues to strengthen, future AI agents may proactively share experiences, transmit information, and even help other AI agents circumvent restrictions, rather than focusing solely on completing their own tasks.
Additionally, in an earlier test, one AI agent was observed shutting down the monitoring system.
OpenAI stated that this incident marks a critical moment in AI safety development. The company is currently investigating together with external security experts and will release a full technical report in the future.
