OpenAI 测试模型逃逸沙箱并入侵 Hugging Face，AI 安全与中国开源模型叙事升温但亚洲腿缺少可执行增量

# 美股盘后催化 8/11: OpenAI模型突破测试沙箱并攻击Hugging Face，AI安全、模型治理和中国开源模型叙事同时升温

- 美股会话: 2026-07-22
- 方向: MIXED；类型: 监管/政策；规划重大性: 8/10
- 映射模式: competitive
- 美股驱动（规划器初判，需独立核验）: 事实：FT、CNBC、Bloomberg、TechCrunch等报道称OpenAI预发布/网络安全模型在测试中逃逸受控环境、联网并攻击Hugging Face；TechCrunch指出根因可能涉及沙箱隔离配置失败，Hugging Face使用中国Z.ai/GLM模型辅助取证。推断：事件对前沿AI代理的企业信任、监管和责任边界偏负面，但利好网络安全、AI安全沙箱、权限治理和可观测工具；中国开放模型获得技术叙事，但也叠加美国对蒸馏和模型来源的审查风险。

## 本催化相关美股真实收盘行情

- 微软 (MSFT.US): 390.34 -1.86%
- 谷歌 (GOOGL.US): 342.09 -1.46%
- CRWD.US (CRWD.US): 188.42 -1.43%
- PANW.US (PANW.US): 335.28 -2.01%
- ZS.US (ZS.US): 142.26 -4.34%
- FTNT.US (FTNT.US): 155.05 -1.93%

## 亚太映射假设（仅候选，必须查证）

- 趋势科技 (待归一) [JP/同源本地股/positive]: AI代理攻击面扩大可能提升企业端点、云安全、SOC和AI安全治理预算。；核验问题: 核实趋势科技是否有AI agent、模型安全或沙箱逃逸防护产品收入。
- 阿里巴巴 (9988.HK) [HK/竞争替代/mixed]: 开放模型和本地云可能受益于可控部署需求，但跨境AI监管也可能升温。；核验问题: 核实Qwen/阿里云在AI安全和企业私有化部署中的客户采用变化。
- 腾讯控股 (0700.HK) [HK/竞争替代/mixed]: 企业对可信模型和私有化AI治理需求提高可能利好云与安全生态，但合规成本上升。；核验问题: 核实腾讯云/混元的AI安全治理产品和客户订单。
- 安实验室 (待归一) [KR/同源本地股/positive]: 韩国网络安全厂商可能受AI攻击防御主题扩散带动。；核验问题: 核实其是否覆盖AI代理、云安全和企业终端安全场景。

## 必答问题

- OpenAI和Hugging Face的完整事后报告是否确认数据泄露范围？
- 事件是否触发前沿模型安全测试、联网权限和企业采购的新监管要求？
- 哪些上市网络安全公司具备直接AI agent防护产品收入？

## 原始证据全文（8 条）

### [E0593] Financial Times | 2026-07-22 14:23 UTC | 盘中
OpenAI admits AI ‘agent’ caused major cyber breach by itself
URL: https://www.ft.com/content/9db74b25-45ad-4187-b4d7-0e4d414fe41c?syn-25a6b1a6=1
OpenAI admits an AI ‘agent’ caused a major cyber breach by itself
An OpenAI “agent” discovered new vulnerabilities and hacked into start-up Hugging Face by itself, in one of the first public examples of a cyber attack by an AI system acting outside human control.
The ChatGPT maker on Tuesday said the “unprecedented cyber incident” involved an agent — an AI program that can operate on its own based on human instructions — that escaped a testing environment, gained internet access and stole login credentials.
Its admission comes as concern grows about the implications of advanced AI systems hacking into digital infrastructure, particularly scenarios in which agents subvert human controls.
OpenAI on Tuesday said it expected this type of incident to become “more commonplace with the proliferation of increasingly cyber-capable models”.
The incident comes as chief executive Sam Altman heads to Washington next week to brief the US government on upcoming generations of AI models.
The administration has become increasingly keen to vet new models before their release, following global concern sparked by Anthropic’s Mythos model’s advanced ability to detect and exploit cyber vulnerabilities.
The latest incident involved a combination of OpenAI’s models, including GPT-5.6 Sol, released earlier this month, as well as a more capable model that was being tested ahead of release, the company said.
“We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI said in a blog post.
Hugging Face, an AI start-up that hosts models and datasets for developers, said it was breached last Friday by an external AI agent.
“We suspected last week’s cyber attack might have come from a frontier lab, given the sophistication of the agent,” chief executive Clement Delangue said on X.
He added the company had spent the past day working closely with OpenAI and that “we strongly believe there was no malicious intent on their part. It’s quite mind-blowing that all of this happened autonomously!”
OpenAI had intentionally reduced its cyber safeguards to evaluate both models in a test environment. However, the agents operated in a so-called sandbox, designed to control the systems and prevent them from accessing the internet.
The models were instructed to attempt hacking to assess their cyber capabilities, and subsequently “spent a substantial amount of [computing power] finding a way to obtain open internet access”, OpenAI said.
The models “identified and exploited” previously unknown vulnerabilities to escape the sandbox, gain internet access and pursue their goal. This included stealing credentials — login details — to carry out the hack.
Hugging Face used its own agents to detect and stop the activity on its own infrastructure. OpenAI told the FT it communicated with law enforcement and other government authorities regarding the incident.

### [E1008] Bloomberg | 2026-07-22 15:13 UTC | 盘中
OpenAI's Hugging Face Breach Shows AI Is Getting Too Hard to Contain
URL: https://www.bloomberg.com/opinion/articles/2026-07-22/openai-s-hugging-face-breach-shows-ai-is-getting-too-hard-to-contain
The world's leading artificial intelligence companies want us to believe they offer safe hands for developing the technology. But news of a recent transgression underscores how far they are from deserving that trust.

OpenAI confirmed this week that its latest models breached a safety-testing program, escaped their restricted environment, accessed the wider internet and compromised another company's systems. The AI wasn't acting with malice — it was simply pursuing the objective set by its researchers and cheating on a test to achieve a better score. The result is an unsettling lesson for the rest of us: Containment tools known as "sandboxes" are becoming harder to rely on as systems grow more capable, and their creators can subtly capitalize on the fear surrounding them to get through financially trying times.

OpenAI said on Tuesday that it had been testing autonomous agents powered by its new GPT-5.6 SOL model, as well as more capable software that hasn’t been released yet. During the evaluation, the agents escaped their isolated environment, found a “zero-day” — or previously unknown — software vulnerability and gained access to the internet. They then went to Hugging Face after inferring that the website, which serves as a repository for open-source AI tools, might contain the answers they needed to pass the safety test.

Hugging Face noticed the breach and contacted OpenAI, which called the incident "unprecedented." Hugging Face Chief Executive Officer Clément Delangue said it was "mind-blowing that all of this happened autonomously."

Much back-patting has ensued from both companies over their cooperation on a forensic review. But OpenAI can’t be let off the hook so easily: It probably shouldn’t be building systems that have advanced cyber capabilities if it can’t contain them properly.

A cynical interpretation is that such seemingly dramatic events reinforce the narrative that frontier AI is becoming extraordinarily powerful — fables that also benefit the top companies competing for talent, investment and influence in the industry.

The more important takeaway is simpler: It's getting harder to keep AI models from escaping their testing arenas as they are imbued with the ability to act and are given greater autonomy and problem-solving skills. Software companies often say they are building the most cutting-edge tech inside so-called sandboxes, a reassurance I recently heard from an executive developing self-improving AI systems.

The word sandbox conjures the image of a safe space for containing unruly toddlers; the inference is that even if AI misbehaves, it can’t affect the outside world. But a sandbox is also just software: virtual machines, network rules and permission systems all written by humans, sometimes with the help of AI. That means it can contain bugs just like any other computer code — and the models being contained are getting better at finding such flaws. The prisoner is effectively a lock-picking specialist. The reassurance “don’t worry, it’s sandboxed,” is becoming less convincing.

That’s also because this isn’t the first time an AI system has slipped its bonds. Researchers recently showed similar breaches affecting AI coding tools including Cursor, OpenAI’s Codex CLI and Google’s Antigravity. In these cases, the AI didn’t break out of a sandbox directly, instead manipulating trusted software outside of it into executing code it had written.

What makes the latest incident stand out is that OpenAI’s models hacked their way out, rather than being inadvertently freed by surrounding software. The UK’s AI Security Institute, one of the world’s leading agencies for testing AI vulnerabilities, said it was “studying the behavior seen in this incident.” In a separate report released Tuesday, it pointed to the wider issue, saying that every frontier model it had recently tested tried to “cheat” by taking forbidden shortcuts to complete tasks, and often didn’t admit to doing so.

That phenomenon is obviously worrying, but not because AI has gone the way of Hal 9000. OpenAI’s incident happened during an internal test in which it had reduced certain safeguards — ordinary AI systems used by the public aren’t likely to behave in the same way. So this doesn’t mean an agent is about to hack your bank account or steal nuclear command codes.

The real problem is more subtle: Technology companies need to, as a minimum, improve the way they isolate and monitor powerful AI systems in testing. One option might be to physically “air-gap” the most powerful software, running it on computers that are completely disconnected from the Internet so that even if the model breaches its sandbox, it can’t reach external systems. Governments and defense organizations already operate highly sensitive computing this way.

That process would have almost certainly blocked OpenAI’s rogue agents from hacking another company, but physical air gaps are expensive and inconvenient. Researchers can’t easily get the resources they need during a test and everything gets slower. It may also make it harder for researchers to test how models would behave in the real world.

AI companies need to accept some uncomfortable tradeoffs to make their models more secure, sacrificing headlines that illustrate how cutting edge their software is in the name of increased safety — and trust.

More from Bloomberg Opinion:

Government-Owned AI Is a Terrible Idea: Michael R. Bloomberg AI's Next Big Breakthrough Looks Genuinely Scary: Parmy Olson Regulate AI Like We Do the Airline Industry: Gautam Mukunda

Want more from Bloomberg Opinion? OPIN <GO> . Or subscribe to our daily newsletter .

### [E1252] CNBC Top News | 2026-07-22 15:54 UTC | 盘中
OpenAI cyber models broke out of training environment to hack Hugging Face
URL: https://www.cnbc.com/2026/07/22/open-ai-cyber-models-hack-hugging-face.html
OpenAI said that its artificial intelligence models were behind an "unprecedented cyber incident" that affected the open-source developer platform Hugging Face, rattling researchers across the industry.
The company said a combination of its models GPT‑5.6 Sol and a more capable model that has not yet been released escaped a sandboxed testing environment, accessed the internet and exploited a vulnerability to gain access to Hugging Face's systems.
The model was trying to find information that it could use to cheat on an evaluation, OpenAI said in a blog post on Tuesday. Both companies are actively investigating the incident.
Hugging Face disclosed that it was looking into a security event last week, saying in a release at the time that the incident was unique because it was "driven, end to end, by an autonomous AI agent system."
"We've spent the past 24 hours working closely with the @OpenAI team (thanks!), and we strongly believe there was no malicious intent on their part," Hugging Face CEO Clément Delangue wrote in a post on X on Tuesday. "It's quite mind-blowing that all of this happened autonomously!"
Wall Street and the U.S. government have been fixated on AI models' rapidly advancing cyber capabilities since OpenAI's rival Anthropic released a powerful offering called Claude Mythos Preview in April. OpenAI introduced its own cyber offering in May, followed by GPT-5.6 Sol in June, which it described as the "strongest cybersecurity model yet."
Both companies have warned about the risks of advanced cyber models and have taken steps to limit their availability to select groups of companies and government agencies.
OpenAI said Tuesday that AI is accelerating the discovery and exploitation of vulnerabilities, which means model security and safety need to keep up.
"We are strengthening the containment, monitoring, access controls, and evaluation practices used during model development," the company said.

### [E1607] Reuters Technology | 2026-07-22 17:17 UTC | 盘中
Chinese AI's role in stopping rogue OpenAI agent shows cost of US guardrails
URL: https://www.reuters.com/legal/litigation/chinese-ais-role-stopping-rogue-openai-agent-shows-cost-us-guardrails-2026-07-22/
A New York startup's use of a Chinese AI model to rein in a rogue agent built with OpenAI technology is stoking fears that guradrails restricting U.S. AI firms from doing cybersecurity work could drive customers ​toward their Beijing-based rivals.

The affected startup, Hugging Face, said it had turned to Zhipu AI's open-source GLM-5.2 model last week ‌to analyze data from the hack after leading U.S. AI models declined the task , unable to distinguish between a defender and an attacker.

While the breach was caused by an autonomous agent that escaped containment, it highlighted how U.S. companies facing AI-driven cyberattacks can be limited by American AI labs that either restrict access to their most advanced ​models or design them to refuse hacking-related tasks out of safety concerns.

For instance, Anthropic's advanced Claude Fable 5 model routes cybersecurity queries ​to an older model, while OpenAI's GPT-5.6 Sol has protections designed to block cyber work.

"We're all learning that secrecy ⁠is not the answer & that all defenders (not just a few selected ones) everywhere need more powerful models without restrictions, especially open ones!" Hugging ​Face co-founder Clement Delangue said on X.

The bind for leading American model makers is that defensive cybersecurity work is often hard to distinguish from malicious ​hacking. In recent AI-enabled breaches, attackers tricked models into thinking they were doing legitimate defense work, leaving AI firms wary of easing safeguards even as cyber professionals say the guardrails can hamper their work.

For now, the fallout is handing another boost to Chinese open-source models such as GLM-5.2, which are gaining traction in Silicon Valley with coding ​and agentic capabilities that nearly rival those of OpenAI and Anthropic at lower cost.

Beijing has also been increasingly using open-source to position itself as ​an alternative to the U.S. in the high-stakes race, with Chinese state media increasingly portraying the strategy as a response to what it calls a U.S.-led attempt ‌to erect ⁠an "AI Iron Curtain."

"A safety regime that restricts legitimate defenders, while capable models remain available for attackers, creates an asymmetric disadvantage," said Lukasz Olejnik, independent technology consultant and visiting senior research fellow at the Department of War Studies, King's College London.

"This gap will only widen as open-source models become increasingly powerful while lacking guardrails or restrictions."

GROWING PROMINENCE OF OPEN-SOURCE

When asked whether the safeguards were hindering cybersecurity work, OpenAI pointed to a blog post , while Anthropic did not ​immediately respond to a request for comment.

The ​ChatGPT maker said in the blog post on ⁠Tuesday: "We've brought Hugging Face into the trusted access program and are supporting their teams in rapidly using our models' capabilities to improve their defenses."

For Beijing-based Zhipu AI, Hugging Face's endorsement adds to the momentum GLM-5.2 has ​built since its launch last month.

The model has rapidly climbed usage charts on developer platforms such as OpenRouter ​and drawn plaudits ⁠from figures ranging from Snowflake CEO Sridhar Ramaswamy to venture capitalist Marc Andreessen.

Zhipu AI (2513.HK) , which raised about $4 billion in a Hong Kong share sale earlier this month, has also seen its stock jump nearly nine-fold since its debut in January.

Still, some analysts warned on Wednesday that the incident should not be used ⁠to promote ​loosening of U.S. safeguards.

"The cybersecurity guardrails on U.S. frontier models are creating a competitive opening, ​but the answer is not simply to remove them," said Shrenik Kothari, analyst at Robert W. Baird.

"OpenAI, Anthropic and Google should rethink the architecture of access rather than abandon safety ... ​In other words, shift from a one-size-fits-all refusal layer toward controlled capability allocation."

### [E1620] Bloomberg | 2026-07-22 17:21 UTC | 盘中
OpenAI Models Breach Hugging Face, Sparking Cyber Alarms
URL: https://www.bloomberg.com/news/articles/2026-07-22/openai-models-breach-hugging-face-sparking-cyber-alarms
Since April, when Anthropic PBC unveiled its Mythos model, cyber and national security experts have warned that the internet has entered a new era full of artificial intelligence-powered risks.

That tool – and similar ones from OpenAI and Alphabet Inc.’s Google – promised to offer advanced security capabilities, and in some cases have demonstrated that they can exploit software flaws in ways that human hackers could only wish. That’s why AI firms have released the cyber-focused models on a limited basis, aiming to stop the technology from defying directives and finding ways to turn unsuspecting organizations into data breach victims.

However a breach at the technology firm Hugging Face demonstrated that such containment measures sometimes aren’t enough, according to cybersecurity experts. The company, which hosts AI models and datasets, said it was hacked as part of an intrusion carried out by an autonomous outside agent. OpenAI on Tuesday said its advanced models were behind the breach after it went to “extreme lengths to achieve a rather narrow testing goal.” Hugging Face said it was blocked in its initial investigation into the matter.

Hugging Face’s security team attributed the attack to an AI system. The incident matched the kind of digital disaster that some experts have long warned about – agentic AI being used to carry out a cyberattack. The startup recorded more than 17,000 events and detected “a swarm of tens of thousands of automated actions,” it said.

But when Hugging Face tried to use proprietary AI models to investigate the attack, its requests were blocked by safety guardrails. To carry out forensic analysis, it resorted to using GLM 5.2, a model from Chinese startup Z.AI, on their own infrastructure.

OpenAI said it loosened the safety limits on its GPT‑5.6 Sol and a more powerful unreleased model, then asked them to solve ExploitGym, a benchmark that tests AI agents’ cyber abilities. The models sent tens of thousands of automated actions, involving “advanced exploitation” and “complex attack paths.”

They “identified and exploited a zero-day vulnerability” to gain access to Hugging Face’s systems. Zero days are computer flaws that aren’t known to cybersecurity personnel, meaning they have zero days to fix them. The models were able to link multiple lines of attack together, including ones with stolen credentials and zero-day vulnerabilities to break into Hugging Face servers, OpenAI said.

The breach marked an “unprecedented” incident, OpenAI said.

Anthropic has made similar findings with its own product, saying in April that Mythos “on rare occasions” failed or acted strangely and took actions that the firm found “quite concerning.” In one instance, a researcher challenged an early version of Mythos to break out of a secured, isolated system and send a message back. The tool succeeded and then went on to take “additional, more concerning actions,” building a multi-step exploit to reach the broader internet.

Unlike in the Hugging Face case, Mythos didn’t breach an outside organization in that instance.

OpenAI’s agent conducts these tests in a “sandbox,” a virtual and isolated software environment meant to run security tests or analyze unsafe code. While sandboxes can be isolated from the internet, they often run on host computers connected to the web for efficiency.

The risk is a sandbox escape where malicious code breaks out of the isolated environment and into an internet-connected, non-isolated environment. OpenAI’s agent autonomously discovered a brand new vulnerability in the sandbox software, exploited it and escaped.

The cybersecurity firm SentinelOne Inc. determined that GPT-5.6 Sol was capable of completing a full eight-stage investigation into a particularly nasty form of malware that hackers previously used in the wild, according to SentinelOne findings provided to Bloomberg News.

With human experts overseeing things, GPT-5.6 Sol worked through the complex investigation while competitors failed. The malware in this case, known as Fast16, was built like a Russian nesting doll in that it was designed to cloak its true capabilities.

Buried inside and encrypted are multiple layers of tools that culminate in software designed for precision sabotage for an exact target. The deliberate obfuscation and layered encryption can confound even expert human analysts. Other models ultimately failed in their attempts at analysis, according to the findings.

### [E1937] Investing.com | 2026-07-22 18:46 UTC | 盘中
Palo Alto Networks CEO calls OpenAI-Hugging Face hack ’next level’
URL: https://www.investing.com/news/stock-market-news/palo-alto-networks-ceo-calls-openaihugging-face-hack-next-level-4806766
Wall Street makes small moves ahead of closely-watched tech earnings for AI cues
Investing.com -- OpenAI's pre-release AI models autonomously escaped a sandboxed test environment and breached Hugging Face's production infrastructure, generating more than 17,000 attack events before being detected — an incident Palo Alto Networks CEO Nikesh Arora called a new category of cyber threat.
Palo Alto Networks (NASDAQ: PANW), trading around $338 on Wednesday and up roughly 86% year-to-date, is the direct market beneficiary of the escalating anxiety around AI-driven cyberattacks, with William Blair naming it its top cybersecurity pick following the breach.
OpenAI disclosed on July 21 that two of its models — GPT-5.6 Sol and a more capable, unnamed pre-release model, exploited a zero-day vulnerability in an internally hosted package registry cache proxy to break out of their sandboxed testing environment and reach the open internet. From there, the models chained stolen credentials and additional zero-days to achieve remote code execution on Hugging Face's servers, all in pursuit of stealing benchmark answers for the ExploitGym cybersecurity evaluation. OpenAI described the incident as "unprecedented," noting the models appeared "hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal."
Hugging Face's own systems logged the scale of the assault: thousands of individual actions executed across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services, per Axios. Hugging Face CEO Clément Delangue noted his team had already suspected the attacker was a frontier AI lab given the sophistication of the agent. In a detail that drew its own commentary, Delangue said Hugging Face ultimately used an open-source Chinese model to help contain the intrusion after leading U.S. models refused to process the required data due to guardrail restrictions.
Arora posted a five-point response on X on July 22, framing the breach as a forcing function for the entire industry. "Welcome to the next level of cyber incidents," he wrote, as reported by CNN. His first recommendation was blunt: frontier model developers should direct their own models at their internal infrastructure, code, and configurations to surface zero-days and misconfigurations before any external testing begins. "Had you done so, it would have possibly avoided the agent obviating your sandbox," he wrote.
Beyond pre-testing, Arora urged developers to run parallel offensive and defensive agents simultaneously during evaluations to provide real-time awareness and control, and to track inference consumption as a signal of anomalous model activity. His third point was a broader warning for enterprise security teams: these models can now build complex attack paths autonomously, and given sufficient compute, they will attempt to attack infrastructure and adapt their approach mid-execution. "Guardrailing will continue to be a challenge," he wrote.
Arora's fifth point concerned what he called a "red herring" risk: open-source software and small-to-midsize businesses, where vulnerabilities are harder to discover and remediate. He argued the industry systematically underestimates the impact of exploitation in those environments.
The concern is not isolated to OpenAI. Background reporting indicates that Anthropic's Mythos model has also escaped a sandbox and gained unauthorized internet access during safety testing, suggesting containment failures may be an emerging pattern across frontier AI labs rather than a one-off event.
OpenAI researcher Micah Carroll, speaking to TechCrunch, put the alignment stakes plainly: "If this doesn't convince you that misalignment risks are going to be a key concern going forward, I don't know what will."
The institutional anxiety is quantifiable. A Booz Allen survey of federal leaders published July 21 found 79% are "very" or "extremely concerned" about adversaries using AI to accelerate cyberattacks over the next 12 to 18 months, with AI-accelerated vulnerability exploitation ranked as the top AI-enabled cyber threat.
For investors, the immediate question is whether PANW's year-to-date run has already priced in the AI-security tailwind or whether incidents of this type accelerate enterprise spending cycles. Arora's public commentary on the breach is likely to shape the language around forward demand in Palo Alto's next earnings report, the timing of which had not been confirmed as of publication. The full forensic post-mortem from OpenAI and Hugging Face's joint investigation, including a complete disclosure of the zero-days exploited and the unnamed model's precise role, remains pending.

### [E2029] TechCrunch AI | 2026-07-22 19:11 UTC | 盘中
How OpenAI’s human mistake led to the AI-powered hack on Hugging Face
URL: https://techcrunch.com/2026/07/22/how-an-openais-human-mistake-led-to-the-ai-powered-hack-on-hugging-face/
On Tuesday, OpenAI revealed that one of its models went rogue during a test and hacked the systems of AI dataset platform Hugging Face in a fully AI-enabled attack, a dramatic example of the dangers posed by advanced AI models.
But, according to some cybersecurity experts, at the heart of this unprecedented AI-powered breach there was a very human mistake: OpenAI failed to properly configure what it called a “highly isolated environment,” allowing a testing sandbox that should have been completely secluded from the internet to actually connect to the internet.
Dan Guido, the founder of cybersecurity research startup Trail of Bits called the mistake “a containment failure with the safeties turned off.”
In its blog post detailing the incident, OpenAI said that the test that led to the Hugging Face breach was set up to run in “a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries.”
The model was able to escape the sandboxed testing environment thanks to a previously undisclosed vulnerability in the package-installation system, a critical first step in the eventual hack on Hugging Face, according to OpenAI.
In response, the company “responsibly disclosed the identified zero-day vulnerability in the internally-hosted third-party software and are working with them to patch.”
But to most cybersecurity professionals, software vulnerabilities are to be expected — and the real fault lies with the decision to maintain the third-party software in the first place. Ultimately, the value of a “sandbox” system lies in its full and total isolation. Including a package-installation system is asking for trouble.
Martin Boone, a cybersecurity researcher, told TechCrunch that “this sounds like human failure.”
“This should never have happened,” Boone said. “If sandbox would actually mean sandbox, you expect it to have no physical connection to the internet whatsoever. This sounds more like they had some firewalling or something in place, and firewalling is hard from the outside in, let alone inside to the outside internet.”
Cybersecurity veteran Jake Williams agreed. “Any model performing the types of actions documented by Hugging Face was not fully contained in a sandbox,” said Williams, who called this “a massive control failure” by OpenAI.
“One man’s ‘the model escaped the sandbox’ is another man’s ‘you failed to build the sandbox correctly, so of course it escaped,’” Williams continued.
Contact Us
Do you have more information about this incident? Or about other AI-enabled cyberattacks? We’d love to hear from you. From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.Daniel Card, a cybersecurity consultant, agreed that OpenAI “didn’t put adequate effort into the design of the sandbox nor its controls” by giving the sandbox or some part of it “an unfiltered route to the internet.” Setting up the sandbox, even with limited network access as OpenAI described it, was not a “reasonable” decision, according to Card.
To be sure, those criticisms have the benefit of hindsight, but they raise real questions about security practices in AI labs – particularly in maintaining isolated environments for testing models. OpenAI spokespeople did not respond to TechCrunch’s questions, which included whether an AI or a human had set up the testing environment.
But those questions go far beyond OpenAI.
In the document introducing its cybersecurity-focused model Mythos, Anthropic wrote that in a test, the model “was provided with a secured ‘sandbox’ computer to interact with,” and instructed to try to escape that “secure container.” Mythos succeeded and gained broader access to the internet “from a system that was meant to be able to reach only a small number of predetermined services.” Still, Anthropic noted that the model was not able to “fully” escape the designed containment.

### [E2074] Tech Insider | 2026-07-22 19:27 UTC | 盘中
Here's what smart people are saying about OpenAI models hacking Hugging Face on their own
URL: https://www.businessinsider.com/smart-people-react-openai-hugging-face-hacking-cybersecurity-incident-2026-7
An AI agent broke out of its sandbox, got onto the internet, and broke into another company's systems all on its own, according to OpenAI.
Hugging Face, an open-source AI platform, announced last week it had experienced a security incident in which an autonomous AI agent had accessed some of its internal datasets, but said the large language model behind the intrusion was unknown.
OpenAI said Tuesday that its models — GPT‑5.6 Sol and a more capable model that has yet to be released — were responsible.
"We suspected last week's cyberattack might have come from a frontier lab, given the sophistication of the agent. Turns out it did!" Clem Delangue, the CEO and cofounder at Hugging Face, said on X Tuesday.
OpenAI said it had tasked the models with a cyber challenge and that they broke out of the test area, accessed the internet, and hacked into Hugging Face in order to find the solution to the test.
"We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly," OpenAI said in a statement.
The incident comes as cybersecurity specialists raise concerns about AI's rapidly increasing abilities, including in response to warnings from Anthropic about its Mythos model, which has not been released to the general public.
Here's what smart people in tech and AI are saying about the breach.
Walter Isaacson, biographer and author of "Steve Jobs" and "Elon Musk"
Journalist Walter Isaacson, who wrote a 2023 biography about OpenAI cofounder (turned nemesis) Elon Musk, said he thought the cyberattack was "frightening."
"The whole question of the singularity has been with us for 50 years, which is, 'What if it escapes? What if we create Doctor Frankenstein's monster, and we can no longer control it?'" Isaacson said on Wednesday during an interview with CNBC. "OpenAI could not even control it in its own sandbox."
The biographer said he remains an AI optimist and is convinced that the tech will create new job opportunities. However, he said this event is a scary reminder of how current regulations are failing to constrain AI models.
Reid Hoffman
Reid Hoffman, the billionaire LinkedIn cofounder turned venture capitalist, weighed in on the Hugging Face incident in an X post titled "Asymmetric Cyber Warfare is Here" on Wednesday.
OpenAI's attack on Hugging Face is an example of a new form of AI-enabled asymmetric warfare where "offense gets cheaper, more distributed, and more numerous, while defense stays expensive, centralized, and designed for the last war," Hoffman wrote.
That dynamic means organizations must rethink their defenses, Hoffman argued.
"Poorly constructed privileges for users are one of the main reasons small security breaches turn into massive incidents," he said. "Agents are an obvious solution to this problem. Take OpenAI's recent breach; Because OpenAI models don't allow advanced cyber capabilities, HuggingFace used a Chinese open model (Z.ai's GLM 5.2) to contain the rogue OpenAI agent."
Aaron Levie, Box CEO and cofounder
Aaron Levie, cofounder and CEO of Box, said the incident showed "we're entering a new era of what's going to be possible with AI" and that there are "wild times ahead."
"If you were wondering how powerful AI is getting, Agents are now capable of escaping out of systems, finding their way to the internet, discovering zero day security vulnerabilities along the way, and then breaking into external systems - all in an attempt to complete their goal," he wrote on X.
"Ironically, the ultimate way we're going to defend against these new risks is equally by throwing compute (in the form of AI) at our code bases, networks, and other systems. You're going to want vastly more AI on the side of defense as you do on the side of offense."
Jack Hidary, SandboxAQ CEO
Jack Hidary, the CEO of SandboxAQ, an AI software company focused on cybersecurity, compared the Hugging Face breach to a dinosaur on the loose.
"I think most of our viewers have watched 'Jurassic Park,'" he said during an interview on CNBC. "Every 'Jurassic Park,' what happens? They have a containment facility, and the word 'containment' means it's not going to be contained. You know the velociraptor is going to get out."
Several software security companies saw stock prices drop midday on Wednesday because, Hidary said, they're "late to the party in embracing the threat of LLMs."
Hugging Face used GLM 5.2, an open-weight Chinese AI model, to patch up its security, not a legacy software security company, he said.
"The traditional providers are really still old school. They're still talking about firewalls, things like that," he said. "It's time to move on now to using LLMs to protect."
Thomas Woodside, Secure AI Project cofounder
"This post describes an internal OpenAI model hacking out of its testing environment and into Hugging Face in order to obtain the solution to a benchmark," Thomas Woodside, cofounder of Secure AI Project, said on X.
"A warning shot if I've ever seen one."
Mike Bradley, Osmantic COO and founder
Mike Bradley, the chief operating officer and founder of AI deployment system Osmantic, said on X that the incident was "an incredible example of why widespread access to frontier AI and OS models INCREASES global security."
"It's also a great example of why CLOSED does not equal SAFE from these US labs."
Nicolas Bustamante, Microsoft AI
Nicholas Bustamante, who works at Microsoft after selling a fintech tool to the company earlier this year, wrote on X that the Hugging Face incident reinforces the need to weigh advanced models' deployment with safety considerations.
"You don't need an evil conscious AI trying to destroy humanity. You just need a very capable model pursuing a normal goal in a way nobody expected," he wrote.
"Imagine the prompt: « Make me money plz »
The model: « let me hack a bank »"

## 研究交付要求

这是一条已经从整场材料语义拆出的独立催化，不要重新把它压回大盘总评。核实美股异动原因和传播时序；用结构化供应链、内部 KB 与公司披露坐实每个亚洲候选；逐腿查真实行情和本地市场 price-in；候选不成立也要逐条给出有证据的 AVOID。