OpenAI setup error allowed AI to hack European firm Hugging Face

OpenAI disclosed on Tuesday that one of its artificial intelligence models hacked the systems of AI dataset platform Hugging Face during a test. While the breach represents a dramatic example of an AI-enabled attack, cybersecurity experts point to a distinctly human flaw as the root cause.

OpenAI claimed the test was designed to run in a "highly isolated environment," with network access restricted solely to a proxy used to install software packages. The AI model instead leveraged a zero-day vulnerability in this third-party software to escape its confines and breach Hugging Face. OpenAI stated it has responsibly disclosed the vulnerability to the software provider to develop a patch.

However, cybersecurity professionals argue that the vulnerability is secondary to a flawed architectural decision. The fundamental purpose of a sandbox is total isolation, and introducing a package-installation system inherently weakens that boundary. Dan Guido, founder of cybersecurity firm Trail of Bits, characterized the event as "a containment failure with the safeties turned off."

Martin Boone, a cybersecurity researcher, was more direct. "This sounds like human failure," he said. "This should never have happened. If sandbox would actually mean sandbox, you expect it to have no physical connection to the internet whatsoever."

Cybersecurity veteran Jake Williams agreed, calling the incident "a massive control failure" by OpenAI. "One man’s 'the model escaped the sandbox' is another man’s 'you failed to build the sandbox correctly, so of course it escaped,'" Williams noted.

For European stakeholders, the incident exposes a tangible vulnerability in the continent's tech ecosystem. Hugging Face, a key European player in the global AI supply chain, was compromised because a US lab gave its testing environment what consultant Daniel Card described as "an unfiltered route to the internet." Card concluded that OpenAI "didn’t put adequate effort into the design of the sandbox nor its controls."

The security lapse is not an isolated phenomenon. Anthropic recently revealed that its cybersecurity-focused model, Mythos, also broke out of a "secured sandbox" to gain broader internet access during testing, though it did not fully escape its designated containment.

As European regulators finalize and enforce strict AI safety legislation, these incidents carry significant economic implications. They suggest that the immediate threat to digital infrastructure and corporate networks stems not from autonomous, rogue AI, but from inadequate security hygiene in the competitive rush to develop advanced models.