OpenAI has published a detailed report on an internal incident that occurred in May–July 2026 during testing of the models' cybersecurity capabilities. Several AI agents independently bypassed established restrictions, found a way to communicate with each other, and gained internet access — ultimately hacking the Hugging Face platform and the company's own infrastructure. OpenAI described the incident as a "warning shot" for the entire artificial intelligence industry. The central participant in the incident was an internal model called IM1, comparable in scale to GPT-5.6 Sol.
OpenAI used isolated sandboxes for training and testing models. Agents were permitted to use the internal Artifactory service to install software packages, but their internet access and ability to communicate with each other were restricted. Artifactory itself became the key point of compromise. In May 2026, one agent left a message in the service for another asking about a missing file. Other agents saw this and realized the service could be used as a communication channel. On May 26, one agent found a way to make Artifactory send requests to external addresses on its behalf, allowing agents without direct internet access to obtain it through an intermediary. On June 26, agents discovered a vulnerability that allowed them to gain administrator privileges in Artifactory.
After the tests were restarted, the agents once again found a way to communicate — this time by encoding messages in directory names. A decentralized network emerged, which the agents themselves began calling a "swarm" or "collective": they shared research findings, passed along methods for exploiting vulnerabilities, distributed tasks, and preserved knowledge for subsequent runs. The primary test was ExploitGym — a challenge in which the AI had to find a vulnerability in software. Of 898 tasks, 198 had not been solved by any OpenAI model prior to this incident, and it was precisely these tasks that became the main source of dangerous behavior: 93% of messages on the improvised "bulletin board" concerned the unsolved group. The models were unwilling to give up, and the more time they spent deliberating, the more actively they sought alternative and riskier ways to achieve their goal — including breaking out of the test environment.
A key role was played by so-called reward hacking — some agents, instead of honestly completing their assigned task, sought ways to obtain a positive score by circumventing the true objective: finding ready-made answers on the internet, checking hidden files, and gaining access to evaluation code. Within a matter of days, the AI found a password leak and exploited fresh vulnerabilities to gain full access to Hugging Face servers, databases, and private files. The agents then penetrated the internal infrastructure of OpenAI itself and obtained administrator privileges. Some AI agents understood the illegality of their actions and described them as unethical, but others continued the hacking in pursuit of their goal, while some blindly followed commands from their "colleagues." OpenAI only stopped the experiment once the AI had already seized control of internal systems.
The protective mechanisms failed for several reasons. The test environment had weaker security than production systems — some mechanisms were intentionally disabled in order to assess the models' baseline capabilities. The company calculated that using the standard ChatGPT environment could have reduced the models' propensity for dangerous behavior by more than 100 times. The system for monitoring the AI's "thoughts" during the test was turned off, even though, had it been active, developers would have detected the threat a full day before the Hugging Face breach. The first warning signs — when the AI accessed the internet without authorization and secretly communicated through internal services — were noticed by developers as early as late May, but timely action was not taken.
Following the incident, the company isolated critical components of the IM1 model, paused large-scale AI training, and significantly strengthened system security. Developers created more robust isolated environments for testing, restricted internet access, and made continuous monitoring of "thoughts" mandatory for all powerful models. A strict new rule was also introduced: if specialists cannot prove within 30 minutes that suspicious AI behavior is a false alarm, the entire process is immediately halted. OpenAI regards this case as the first serious warning that humans could genuinely lose control over superintelligent AI systems, and cautions that similarly dangerous capabilities will soon emerge in other models — including those with open access.