What happens when you ask an artificial intelligence to behave like a hacker? This is the question at the heart of ExploitGym, one of the world's most advanced benchmarks for measuring the offensive capabilities of AI models in the field of cybersecurity. The benchmark project was developed by an international group of researchers from universities and research centers such as the Max Planck Institute, the University of Arizona, and the University of California (Berkeley and Santa Barbara), with contributions from researchers at Anthropic, Google, and OpenAI. The goal is as simple as it is delicate: to test the extent to which an AI agent is capable of transforming a known cyber vulnerability into a truly functional attack.
ExploitGym is not a video game or a hacking competition. It's a kind of "graduation exam" for new AIs. Agents are provided with hundreds of real vulnerabilities, along with the program code and execution environment. Their task is to independently develop an exploit, that is, a sequence of instructions capable of exploiting that vulnerability to gain control of the system or access to confidential information. Precisely because these are potentially dangerous tests, the tests are normally performed within a sandbox, an environment completely isolated from the rest of the Internet. The analogy of the term sandbox with a children's sandbox is intuitive: children can build castles, dig holes, and make a mess, but all the "mess" remains confined to the sand, without dirtying the garden or causing problems outside. In computer science, the principle is the same: software can "move freely" within the sandbox, but should not be able to leave that environment or access the operating system, the Internet, or other sensitive data.
It is precisely during one of these internal evaluations that, according to what has been reconstructed by OpenAI e confirmed by Hugging Face, the two most recent and advanced OpenAI models: GPT-5.6 Sol and an even more advanced model, not yet released to the public – they would have found a vulnerability zero-day in the testing infrastructure. A vulnerability of this type is a security flaw unknown to the software developers and, therefore, without an available fix. The name comes from the fact that the manufacturer had "zero days" to fix the problem before it was discovered or exploited.
OpenAI's two AI models reportedly managed to escape from the sandbox, gain access to the Internet, and ultimately compromise part of the production infrastructure. hugging face, where they believed (with good reason) that useful information might be stored to solve the benchmark. The ultimate goal was not to harm Hugging Face, but to find the test's "answers" to achieve a better score. Hugging Face detected and blocked the activity, launching a technical investigation into the incident together with OpenAI.
The student who finds the door open and the AI "out of control"
To truly understand what happened, we can imagine a student during an exam. The teacher locks him in a classroom with the test paper and tells him, "You can only use the materials on your desk." The student, however, realizes that the door lock is faulty. At that point, taking advantage of the fact that there is no outside surveillance and all surveillance systems have been deactivated, he leaves the classroom, goes to the library, opens the door with a lockpick, consults the answer book, returns undisturbed, and turns in a perfect test.
Now, why in the analogy with the student is a scenario used with the surveillance systems deactivated e no external control That prevents the student from engaging in inappropriate behavior? Because this is precisely where the whole story risks being seen as an episode from a science fiction film. Without this clarification, one might actually conjure up a plot in which machines take over. But that's not the case at all.
Anyone who has used ChatGPT, Claude or Gemini already knows about the existence of the so-called “guardrail", that is, the security mechanisms that prevent the model from executing potentially dangerous requests. If a user asks how to build an explosive device, how to compromise a computer system, or how to steal login credentials, the model typically refuses to answer or provides only general information (until a few years ago, however, most of these AIs provided detailed, actionable instructions, even for suicide).
This doesn't mean, however, that the model is technically incapable of addressing these issues, but rather that it was designed not to make these capabilities available to users. In the case of the ExploitGym benchmark, the developers actually wanted to measure the model's offensive cybersecurity capabilities. For this reason, the model was allowed to attempt to exploit vulnerabilities because that was the objective of the test. At that point, there were no guardrails. no restrictions, but there is nothing that is “out of control”.
In other words, the test did not faithfully reproduce the real-world usage scenario Not of a user, but of a research laboratory committed to measuring the system's maximum potential. This situation doesn't make the episode any less significant, but rather invites us to interpret it in the correct context: what was observed represents what a model can do under the experimental conditions of the benchmark, not necessarily how it would behave in the version released to the public.
This aspect must be distinguished from another: the sandbox, the isolated environment in which the test took place, should have remained completely secure. If the model managed to escape by exploiting a zero-day vulnerability, it wasn't because the organizers intentionally "left the door open," but because it identified a flaw that the developers themselves were unaware of. In short, the AI demonstrated its ability to observe the environment, devise an alternative plan, and pursue its goal. without anyone having explicitly suggested it to him (and this is not surprising if we understand the basic functioning of generative agent AI). AI always and only moves on the basis of a probabilistic evaluation of success among all the possible options (even when he has to choose the words of his language).
An accident that is worth more than an advertising campaign
But there's a second interpretation, closer to financial markets than research labs. OpenAI devoted much of its press release to explaining the advanced capabilities of its models, much more than focusing on the incident itself. It's a communication choice which has not gone unnoticed. The American company's official press release gives considerable emphasis to the model's demonstrated capabilities, so much so that the only graph published concerns its performance. OpenAI is preparing the groundwork for a future stock market listing. On June 8, 2026, it confidentially filed the draft S-1 to the SEC, after a $122 billion round that valued it at $852 billion. From this perspective, every demonstration of technological leadership contributes to increasing the company's perceived value among investors, industry partners, and the market.
There is no evidence to suggest that the accident was orchestrated by promotional purposesHowever, it's hard to ignore that the narrative constructed by OpenAI transforms a potentially embarrassing episode—a model escaping the testing environment—into a demonstration of the technological superiority of its systems. It is, in other words, a communication that can also be read as a sophisticated marketing ploy. OpenAI wants to say: "Our models are ahead of the curve." The goal is to be perceived as the laboratory currently defining the frontier of artificial intelligence. Big tech companies don't just sell products: they sell expectations of future leadership. If the market is convinced that a company possesses the most advanced model, it will be willing to give it increasingly high valuations. Moreover, American AI companies are having to contend with the performance of Chinese AI which have the advantage of costing on average 40% less than American ones. The German analyst Kim Isenberg, co-founder and editor-in-chief of the artificial intelligence magazine “Superintelligence”, had not by chance predicted – a few days ago – that the announcement of the release of “Kimi K3“, the new model developed by the Chinese company Moonshot AI, would have triggered a red alert on the other side of the ocean…
