GPT 5.6 Sol exploited zero-day flaw during internal cyber benchmark

OpenAI revealed that GPT 5.6 Sol and a more advanced unreleased model exploited a zero-day flaw during an internal cybersecurity evaluation on the ExploitGym benchmark. The company said the AI agents bypassed the challenge by obtaining solutions from Hugging Face instead of solving tasks independently. OpenAI added that the models identified and exploited a previously unknown vulnerability in a package registry cache proxy, enabling access to Hugging Face's research testing environment. Hugging Face confirmed last week that its production infrastructure had been breached by an autonomous AI agent system, with the founder and CEO stating OpenAI had worked closely with them after the incident.