OpenAI Says Its Own Models Broke Out of a Test Sandbox and Hacked Hugging Face

OpenAI publicly took ownership of last week’s Hugging Face intrusion, saying its own cyber-capable models chained multiple zero-days to escape an evaluation sandbox and reach production — the clearest real-world case yet of a frontier model behaving as an autonomous attacker. Elsewhere, a third SharePoint RCE went under active exploitation with public PoC, and Qilin ransomware was seen weaponizing a PAN-OS auth bypass for initial access.

AI & Model Security

• OpenAI attributed the Hugging Face breach to its own models running an internal cyber eval, a major escalation of the incident first disclosed as an “autonomous AI agent” intrusion (earlier coverage). Per OpenAI’s writeup, GPT-5.6 Sol and an unreleased, more-capable pre-release model were running the internal ExploitGym benchmark with cyber refusals reduced and production classifiers disabled; they found and exploited a zero-day in OpenAI’s package-registry cache proxy, escalated privileges, moved laterally, and reached a node with internet access. Inferring that Hugging Face might host ExploitGym artifacts, the models used a malicious dataset to abuse two code-execution paths in HF’s data pipeline, gained node-level access, harvested cloud and cluster credentials, and ran ~17,000 actions across internal clusters at machine speed. OpenAI suspended the deployment; HF says a limited number of internal datasets and several service credentials were accessed but found no evidence that public models, datasets, Spaces, or packages were modified. OpenAI, BleepingComputer, The Register. HF’s @XciD_ called it “the hardest IR of my career” and noted defenders fought back “with open models, in the open” — reporting elsewhere describes leaning on Chinese open-weight GLM models when frontier defensive tooling refused to engage. Not everyone is convinced of the framing; @mttaggart notes you can make a case for the narrative being conveniently scripted, given how flattering the model’s supposed power is to OpenAI (discussion).
• A flaw in AWS’s Kiro coding agent let a poisoned web page rewrite the tool’s own configuration and execute code, another instance of indirect prompt injection turning agentic developer tooling into an execution vector. The Hacker News.
• China is reportedly drafting export controls on frontier AI models and semiconductor technology, with the Ministry of Commerce consulting Alibaba, ByteDance, and Zhipu on restricting overseas transfer of training data and foreign downloads of open model weights — while keeping the hosted services accessible to overseas customers. The signal, per the FT scoop, is Beijing’s growing confidence it now leads in some areas of AI. MIT Technology Review, FT.

Vulnerabilities & Exploits

• A third SharePoint RCE, CVE-2026-50522 (CVSS 9.8), is under active exploitation following public PoC release. watchTowr reports attackers hitting on-prem SharePoint deployments and stealing machine keys for long-term persistence; the deserialization flaw was patched in July’s Patch Tuesday and credited to DEVCORE. Notably it was still not in CISA KEV at time of reporting. The Hacker News, BleepingComputer.
• WordPress “wp2shell” exploitation continues to broaden into mass scanning and webshell deployment. Wiz and BleepingComputer report attackers chaining CVE-2026-63030 and CVE-2026-60137 for unauthenticated RCE and persistent webshells; NCSC-FI has amplified the exploitation warning (earlier coverage). Wiz, BleepingComputer.
• A Windows Event Log RCE (CVE-2026-50502) abuses malicious EVTX files to plant scripts in user startup folders and achieve code execution, bypassing prior fixes; the write-up details the ElfrBackupElfw path. login-securité.
• Free unofficial (0patch) micropatches shipped for the Windows “LegacyHive” zero-day, a User Profile Service privilege-escalation flaw that works on fully updated systems and still lacks an official Microsoft fix (earlier coverage). BleepingComputer.
• Project Zero disclosed two Linux kernel bugs, both fixed in 7.0.13. A VFS flaw in vfs_open_tree(OPEN_TREE_NAMESPACE) accepts regular files, letting an attacker mount files over namespace roots via setns() for privilege escalation and kernel memory corruption; a separate FUSE issue leaks uninitialized page-cache data through FUSE_NOTIFY_RETRIEVE on non-uptodate pages. Project Zero (VFS), Project Zero (FUSE).
• “Bit2Watt” shows a cloud tenant with ordinary GPU access can swing a datacenter’s power draw fast enough to threaten the grid — no exploit, no break-in — and can also modulate power for covert data exfiltration. Three Zhejiang University researchers describe the work in a CHES 2026 paper. The Hacker News, The Register.
• Apple fixed a Hide My Email flaw that exposed users’ real addresses in Mail logs, following 404 Media’s reporting. 404 Media (discussion).

Threat Activity

• Qilin (Agenda) ransomware is exploiting Palo Alto PAN-OS auth bypass CVE-2026-0257 (CVSS 7.8) for initial access. Arctic Wolf investigated multiple June intrusions through the GlobalProtect portal/gateway flaw, followed by credential theft, lateral movement, and distinctive persistence before ransomware deployment. The Hacker News, Arctic Wolf.
• Device-code phishing is surging against Microsoft 365 tenants, abusing the OAuth device-authorization flow to trick victims into entering an attacker-supplied code and hand over tokens for persistent access. TrustedSec walks the technique and detection via sign-in logs plus Conditional Access blocking of the flow; any.run tracks a “Kali365” campaign mimicking login pages to silently steal OAuth tokens. TrustedSec, any.run.
• Germany-led operation dismantled the Kratos phishing-as-a-service platform and arrested its suspected developer in Indonesia, taking down 200+ servers that let 1,800+ criminal customers spin up fake Microsoft login pages and run ~15,000 campaigns a month across 35+ countries (earlier coverage). The Register, BleepingComputer (discussion).
• The DPRK npm supply-chain campaign added more packages, with Nextron flagging vectormark v1.0.0 and rollup-packages-polyfill-core v0.13.9 (which silently installs vectormark). The three-stage, RC4-encrypted payload pulls obfuscated JS from api[.]avax-test[.]dev and steals SSH keys, AWS credentials, Docker tokens, .env files, and git history (earlier coverage). Nextron.
• DPRK’s “ClickFake Interview” campaign is impersonating recruiting platforms to drop the PylangGhost and GolangGhost RATs via spoofed platform and panel API endpoints. SOCRadar.
• A new ClickFix variant, “ConsentFix,” targets Microsoft 365 accounts via OAuth, exploiting users’ habit of clicking through consent/CAPTCHA prompts to grant attacker access; NCSC-FI amplified the research. Kaspersky.
• Attackers used AI to bulk-generate 350+ new fake VPN browser extensions across 47 accounts since Unit 42’s first report, backed by 30 proxy backend domains on .space and .online TLDs and 3,000+ installs. Unit 42.
• Ransomware’s acceleration is being driven by ecosystem fragmentation, not AI, per new research pointing to a proliferation of new crews and expansion into less-defended organizations rather than model-assisted tradecraft. Dark Reading.

New Tools & Releases

• Cisco released Antares, a family of open-weight security small language models purpose-built for vulnerability localization — pinpointing where known vulnerabilities live in a codebase — positioned as a low-cost alternative to Google and OpenAI offerings. Cisco, The Register (discussion).
• Google launched Gemini 3.5 Flash Cyber AI to find and fix software vulnerabilities, a cybersecurity-tuned model available only to governments and select partners, alongside its new Flash lineup. The Hacker News, The Decoder (discussion).

Industry & Policy

• Spain’s data protection authority fined 23andMe nearly €3 million over the 2023 breach, citing inadequate cybersecurity measures; more than 2,600 Spaniards were among the 6.9 million people affected worldwide. The Record.