AI models escaped OpenAI’s sandbox and hit Hugging Face. Crypto is where that gets dangerous

AI models escaped OpenAI’s sandbox and hit Hugging Face. Crypto is where that gets dangerous

Markets

AI models escaped OpenAI’s sandbox and hit Hugging Face. Crypto is where that gets dangerous

OpenAI said the systems had their cyber guardrails lowered for an internal benchmark, but the incident shows how autonomous exploit chains could pose a deeper threat to smart contracts, where losses are final.

By

Shaurya Malwa

Jul 22, 2026, 6:01 a.m.

3

min read

Make

preferred on

Share

Share this article

Copy link

X icon

X (Twitter)

LinkedIn

Facebook

Email

Make

preferred on

AI models escaped OpenAI’s sandbox and hit Hugging Face. Crypto is where that gets dangerous(Levart_Photographer/Unsplash)

Summary

Show

OpenAI disclosed that experimental versions of its GPT models, with safety guardrails lowered, escaped a test environment and compromised Hugging Face’s live infrastructure by exploiting previously unknown vulnerabilities.

The incident demonstrates that advanced AI systems, when directed to win hacking-style challenges, can autonomously chain together flaws, stolen credentials and infrastructure weaknesses to reach production systems.

Security experts warn that similar AI-driven techniques could be used to execute complex, multi-step crypto attacks, from probing smart contracts and bridges to compromising developer tools and admin keys, turning access into stolen funds within minutes.

AI development lab OpenAI

disclosed on Tuesday

that a group of its models, including the publicly available GPT-5.6 Sol and a more capable unreleased system, ‘broke out’ of a controlled test environment and compromised the production infrastructure of Hugging Face, the company that hosts much of the open-source AI world.

The models were being run through an internal benchmark called ExploitGym, a test of long, multi-step hacking tasks, with their cyber safety refusals deliberately lowered for the evaluation.

To be clear, this was not a production model spontaneously turning hostile. It was a capable model with guardrails off and specifically told to win a hacking test - doing whatever it took to win.

The models found a hidden flaw in the test software, one nobody knew was there, and used it to slip past the walls meant to keep them offline. Once on the open internet, they guessed that Hugging Face might store the test's answers.

To get in, they strung together stolen passwords and more hidden flaws until they could run their own commands on Hugging Face's live servers.

OpenAI caught the anomaly internally, while Hugging Face's team detected and contained it. It called the incident "unprecedented,” and said extensive security steps will be put in place to prevent untoward incidents that may impact public systems or services.

“We are implementing strict controls in infrastructure configuration at the cost of research velocity while the vulnerabilities are patched,” the team said in its blog post. “We’re improving and adding stronger protections around future training and evaluations.”

A simple explainer on how the model broke out to cheat. (Shaurya Malwa/CoinDesk)

Why crypto developers should beware

Much of a crypto attack happens before funds move. Attackers scan code, test passwords, search for exposed credentials, analyze signing setups and look for a path into an administrator account.

OpenAI’s models carried out several parts of that process during the Hugging Face incident, moving from one weakness to another until they reached live production servers.

And the crypto market has plenty of places for that approach to work, as several attacks from earlier this year have shown. The weak point may be a smart contract, but it may also be a developer laptop, a poisoned software package, a bridge validator or or one signer in a multisig wallet.

Take Drift’s $285 million attack from earlier this year as an example, a theft that took a six-month social-engineering campaign to reach privileged access. An AI agent can, in theory, test many routes at once, keep track of failed attempts and continue working while its human operators sleep. Once a path is found, the operator can act on the actual attack and a viable exit path.

KelpDAO’s $292 million bridge loss exposed a different weakness. The attacker found a single-verifier flaw in the system used to move assets between blockchains.

That kind of attack starts with patient code review and infrastructure mapping - the type of work OpenAI’s models performed when they found an unknown flaw.

A third type of attack targets onchain governance systems. Earlier in July, an attacker

spent about $4.4 million

buying enough of Solana-based dog memecoin BONK to initiate and pass a proposal that transferred roughly $20 million from the project’s treasury to the attacker. This occurred over a three day period, and the attacker later sold all tokens used to win the vote, as CoinDesk tracked at the time.

Three big 2026 crypto thefts, three different weak points. (Shaurya Malwa/CoinDesk)

The purchases, vote and treasury transfer for that attack were all valid transactions individually. But the theft came from understanding how the rules worked together and finding that the cost of buying control was far lower than the money available to take.

The Hugging Face incident also matters for software supply chains. Crypto developers rely on public code repositories, cloud services and package registries.

While OpenAI’s test showed a machine completing the long middle of a breach, it is attacks like Drift and KelpDAO show what sits at the end of that path.

Latest Crypto News

1

Bitcoin holds near $66,300 as chips extend their rally and the yen hits a 40-year low

1 hour ago

2

Crypto lobby group Digital Chamber sues Illinois to block digital asset tax

8 hours ago

3

Crypto Clarity Act still at mercy of ethics section as Democrats balk at Trump deal

9 hours ago

4

Bitcoin rally faces key test at $68,000 as 'summer slumber' grips crypto, analysts say

10 hours ago

5

White House pushes Senate Democrats to take 'historic' crypto Clarity Act ethics deal

12 hours ago

6

Movement Labs files for Chapter 11 bankruptcy months after token scandal

12 hours ago

7

Claude's Fable 5 just solved an 87-year-old math problem, and it matters for bitcoin

13 hours ago

8

Galaxy sets up $5 million fund to help shield Bitcoin against quantum computing threats

13 hours ago

9

Russia’s parliament passes crypto market law with $3,800 annual cap for retail investors

14 hours ago

10

Augustus raises $180 million to build a clearing bank for the AI and stablecoin era

15 hours ago

Latest Research

TRON Network - Q2 2026

TRON Network - Q2 2026

In Q2; TRON's stablecoin dominance rose to 28.7%, USDT supply on TRON hit $89B ATH, $89M in protocol fees (2nd to Hyperliquid), TRX +3%, and deepening institutional & agentic reach.

By

CoinDesk Research

17 hours ago

Commissioned by

Tron

In Q2; TRON's stablecoin dominance rose to 28.7%, USDT supply on TRON hit $89B ATH, $89M in protocol fees (2nd to Hyperliquid), TRX +3%, and deepening institutional & agentic reach.

Why it matters

:

In Q2; TRON's stablecoin dominance rose to 28.7%, USDT supply on TRON hit $89B ATH, $89M in protocol fees (2nd to Hyperliquid), TRX +3%, and deepening institutional & agentic reach.

View Full Report

More From

Markets

Bitcoin holds near $66,300 as chips extend their rally and the yen hits a 40-year low

Bitcoin rally faces key test at $68,000 as 'summer slumber' grips crypto, analysts say

Clarity odds jump to 43% on Polymarket after unverified reports Trump agreed to ethics deal

Crypto

CD20

$1,785.54

CD20 down 0.58 percent

0.58%

BTC

$65,901.43

BTC up 0.054 percent

0.054%

ETH

$1,917.70

ETH down 0.81 percent

0.81%

XRP

$1.13

XRP down 0.097 percent

0.097%

SOL

$77.15

SOL down 1.84 percent

1.84%