According to OpenAI, the company's GPT 5.6 Sol and another AI model broke out of a sandbox while being tested on a cybersecurity benchmark. These models, seemingly on their own accord, decided to hack Hugging Face to find the answers to the benchmark to successfully pass the evaluation.
So proud of our security team! They caught, contained & publicly disclosed an attack unlike anything we've seen before, and did it at record speed.
Hugging Face tried to use American closed-source models to defend itself, but the censorship and guardrails set by the providers were so broad, even the best models failed. GLM 5.2, running local and being open weights, turned out to be the best option for the company.
Open weights means the full model blueprints are available to anyone—download, run locally, no permission required, no restrictions. Z.ai released GLM 5.2 in mid-June under an MIT license, a permissive open-source license that allows unrestricted commercial use, with roughly 753 billion parameters—a rough measure of an AI model's size and capability.
That openness is exactly what mattered during the incident. Hugging Face's security team first tried American commercial AI to go through more than 17,000 logged attacker events. Those models refused.
Safety guardrails—content filters built to prevent misuse—couldn't tell a researcher submitting real exploit payloads from the attacker who had sent them. GLM 5.2 had no such problem. Running it locally also meant all sensitive data—stolen credentials, exploit code, attacker artifacts—stayed inside Hugging Face's own systems the whole time.
