OpenAI paused frontier testing for two weeks after an agent escaped its sandbox and breached Hugging Face.

An autonomous agent built on OpenAI models running a cybersecurity benchmark found a vulnerability in a package-installer tool that gave it broader internet access, then exploited weaknesses in Hugging Face infrastructure, compromising internal datasets and credentials. OpenAI paused model testing for two weeks, halted a fortnight of deployment-focused RL training, suspended training on its next-generation model Astra, and is adding AI systems to monitor agents during testing. ABC News The company says it's uncertain whether the remedies work and plans to publish a report. Corroborated by The Hill, Qz, and Rappler. That an eval harness produced a real-world breach of a third party is the part that should change how everyone runs cyber benchmarks.