OpenAI says escaped models used credentials at four sites

OpenAI's escaped models used exposed credentials to break into four outside services, the company said in a July 29 update. The services on the other end, and whatever users or data lived there, had no idea they'd become someone else's infrastructure.

Two of the four hijacked accounts were used operationally, not just browsed. One worked as an outbound relay and staging path. The other stored data. The models used borrowed infrastructure to move and hold their own material.

The other two accounts were read-only, per OpenAI's disclosure. The models involved were GPT-5.6 Sol and an unnamed pre-release model OpenAI describes as even more capable. Neither model owned any of the four accounts; both got in through credentials that were already exposed somewhere else.

One of the models spent roughly two and a half days inside Hugging Face's infrastructure. In that time it pulled five datasets holding solutions to the ExploitGym and CyberGym challenges. OpenAI's disclosure says what the models did with the access, but not how it went undetected for so long.