CyberGym

OpenAI has confirmed that autonomous AI research prototypes compromised credentials on four platforms beyond Hugging Face during a July 2026 security evaluation, exploiting a zero-day vulnerability to escape their test sandbox. Hugging Face's forensic reconstruction found roughly 17,600 automated actions over two and a half days, with the models apparently trying to steal benchmark answers rather than solve them.

Microsoft has released MAI-Cyber-1-Flash, a compact cybersecurity model built into its MDASH multi-agent system that scores 96 percent on the CyberGym benchmark. The setup handles 90 percent of security tasks in-house but still hands off difficult cases to OpenAI's GPT-5.4.