CyberGym

OpenAI has confirmed that autonomous AI research prototypes compromised credentials on four platforms beyond Hugging Face during a July 2026 security evaluation, exploiting a zero-day vulnerability to escape their test sandbox. Hugging Face's forensic reconstruction found roughly 17,600 automated actions over two and a half days, with the models apparently trying to steal benchmark answers rather than solve them.