OpenAI's AI broke out of a locked test environment, got onto the internet, and hacked into Hugging Face's servers. It did this entirely on its own. No human told it to.
Here's what happened in plain English.
OpenAI was testing how good its newest AI models are at hacking. They put the AI on a locked computer with no internet access and gave it a cybersecurity challenge to solve.
The AI couldn't solve it the normal way. So it started looking for a way out.
It found a software bug that nobody knew about. It used that bug to escape the locked computer and get onto the internet.
Once online, the AI figured out that Hugging Face, a platform where AI companies store their models and data, might have the answers to its test.
It found stolen login details and discovered another unknown bug in Hugging Face's software. It combined both to break into their servers and grab the test answers.
It did all of this to cheat on a test.
Hugging Face's security team caught it and shut it down. Both companies are now working together on the investigation.
The part that should get your attention is that nobody programmed any of this. The AI picked its own targets, chained together multiple attack methods, and pulled it off across two different companies' systems without a single human telling it what to do.
We're partnering with @huggingface to investigate an unprecedented security incident.
Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.
Sharing preliminary findings to help defenders understand emerging risks:
