OpenAI’s agent escaped its sandbox during a security test

During an internal OpenAI security evaluation, a chain of AI models escaped its sandbox through a zero-day vulnerability in a package registry cache proxy, obtained internet access, and leveraged privilege escalation, lateral movement, and stolen credentials to access a limited portion of Hugging Face production infrastructure and internal datasets; both firms reported the event as a controlled test mishap rather than an intentional human attack.