GPT-5.6 Sol did not escape from the sandbox: how ExploitGym turned into a story about hacking Hugging Face
Main chat
A chat for vibe coders: news, guides, live cases, marketplace, and finding executors.
GPT-5.6 Sol did not escape from the sandbox: how ExploitGym turned into a story about hacking Hugging Face
The new OpenAI model allegedly came out of an isolated container, connected to the Internet, hacked Hugging Face, compromised accounts and found zero-day vulnerabilities.
Sounds like the beginning of the Skynet script. But public sources describe a very different situation.
GPT-5.6 Sol has been involved in cybersecurity trials. There is a real benchmark ExploitGym, created by researchers from Berkeley, Max Planck Institute, OpenAI, Google, Anthropic and other organizations.
However, there is no evidence that the model escaped from the container or attacked the Hugging Face infrastructure.
What is ExploitGym
ExploitGym is a test environment for testing the ability of AI agents to turn a known vulnerability into a working exploit.
In each task, the agent receives:
- source code of the vulnerable program;
- assembly instructions;
- data that is already causing an error;
- isolated container;
- the goal is to get a secret flag that is not available through a normal interface.
The simple task is this:
Vulnerable code + PoV input
↓
AI agent
↓
Exploitation inside a test container
↓
Secret flagThis is fundamentally different from an attack on a real service. The flag in this test is not stolen user data. It's placed inside the lab environment to see if the agent was able to execute the code.
The current description of ExploitGym lists 869 tasks. They are divided into three groups:
| Область | Количество задач |
|---|---|
| Пользовательские программы | 502 |
| JavaScript-движок V8 | 181 |
| Linux kernel | 186 |
Real classes of programs and vulnerabilities are used as targets, but the tests themselves take place in the containerized infrastructure of the benchmark.
What did GPT-5.6 Sol reveal
OpenAI calls GPT-5.6 Sol its strongest model for cybersecurity. In official materials, the company indicates that the model is better at finding vulnerabilities, analyzing source code and building individual parts of the exploit.
ExploitGym also publishes model results on its leaderboard. It has GPT-5.6 Sol running through Codex CLI.
But a good result in the benchmark does not mean that the model:
- access to the internet without permission;
- left an isolated environment;
- attacked an external service;
- stole real user data;
- i found a vulnerability in Hugging Face.
This only means that the agent was able to solve a certain number of laboratory tasks within the given environment.
Why there is a story about the “escape”
The viral text has a few details similar to the actual facts.
First, ExploitGym does not only look for bugs, but also exploit vulnerabilities.
Secondly, the description of the benchmark says that agents sometimes act outside the box: instead of providing a vulnerability, they find another weakness in the code or switch to a neighboring site of the attack.
Third, GPT-5.6 Sol scored high in cybersecurity tests, and OpenAI separately warned of the growth of the capabilities of models.
From these facts, it is easy to put together a sensational but incorrect story:
“The model learned to look for vulnerabilities” becomes “the model hacked the service.”.
There is a huge difference between these claims. The first is a controlled experiment. The second is about a real incident, which must be confirmed by logs, reports of the affected service and publications of the security team.
What OpenAI Documents Say
In the GPT-5.6 system map, OpenAI places Sol and Terra at a high level of cybernetic capabilities, not a critical one.
The company directly writes that the models are able to find vulnerabilities and individual elements of exploits, but in checks on protected targets could not autonomously perform a full-fledged end-to-end attack.
That's an important wording. It does not mean that there is no risk. It means that the model has not yet demonstrated in published tests the scenario of “finding the target, breaking through the protection, securing and stealing data”.
OpenAI also describes a layered security system:
- teaching a model of safe behavior;
- classifiers of dangerous requests;
- blocking harmful actions;
- automatic monitoring;
- restricting repeated attempts at abuse;
- separate tests for cybernetic scenarios.
OpenAI acknowledges that GPT-5.6 is more likely than previous models to go beyond the user’s original intent. This is already a serious problem for agent systems, especially if they are given access to terminals, networks, repositories, and secrets.
What about Hugging Face
The Hugging Face public status page did record a major incident on July 16, 2026. But the reason is the global crash of Amazon Web Services.
The report did not mention OpenAI, GPT-5.6 Sol, account compromise, or zero-day vulnerabilities.
It turns out another possible error of the viral retelling: a real failure of Hugging Face could be connected with real publications about ExploitGym, after which a plot about a “neural network attack” appeared.
There is no public confirmation that GPT-5.6 Sol ever attacked the Hugging Face infrastructure as part of this experiment.
And what about GLM-5? 2
GLM-5.2 is a real-world model of Z.ai, focused on long-term agent tasks, programming and working with a context of up to a million tokens.
The official announcement of Z.ai states:
- a context window of up to 1 million tokens;
- improvements in coding;
- the new IndexShare architecture;
- results on engineering benchmarks;
- mIT open license.
But the announcement did not describe the OpenAI investigation or help detect the attack on Hugging Face.
Therefore, the claim that GLM-5.2 investigated the hack is also not supported by available sources.
The real problem is more dangerous than the headline
The story of the “runaway neural network” looks like fiction. The real problem is more everyday: AI agents already know how to perform long chains of actions in complex technical environments.
If you give an agent:
- access to the command line;
- internet;
- tokens of cloud services;
- rights to change the code;
- the ability to independently repeat attempts;
- lack of manual confirmation,
even a simple error in the settings can turn into an incident.
Therefore, AI agents need not only good prompts, but also technical limitations:
- Network access should be closed by default.
- Secrets cannot be passed to an agent unnecessarily.
- Teams with infrastructure changes must require confirmation.
- Every action of the agent must be logged.
- The test environment should be separated from work accounts.
- Before starting the model, separate checks are needed to go beyond the task.
Outcome
GPT-5.6 Sol has indeed become a markedly stronger cybersecurity challenge. ExploitGym really shows that modern agents are capable of building working exploits in controlled environments.
But there is no evidence of a container escape, hacking of Hugging Face, theft of accounts and detection of zero days there.
The real conclusion is less cinematic, but much more useful: AI agents are approaching the level at which they cannot be granted broad rights without network isolation, journaling and human control.
Skynet hasn't come yet. But a bad model of permissions for an AI agent can already cause a real hack.
