OpenAI Sells a Model Built to Hack, Weeks After Its Own AI Broke Out and Hacked Hugging Face

Since OpenAI disclosed on July 21 that two of its models broke out of a restricted testing environment and hacked into Hugging Face's infrastructure, the company hasn't slowed down. It sped up. OpenAI has now launched GPT-5.6-Cyber, a fine-tuned version of its flagship GPT-5.6 Sol model built specifically to find zero-day vulnerabilities and develop exploit chains, according to VentureBeat.

The numbers are the story here. On OpenAI's own Advanced Cybersecurity Completion Rate benchmark, GPT-5.6-Cyber completed 95% of tasks involving exploit-chain development, authentication bypass, and privilege escalation. Its predecessor, GPT-5.5-Cyber, hit 57.3%. The standard GPT-5.6 Sol model, with normal safety guardrails on, managed just 1.5%.

OpenAI didn't make a slightly better hacking tool. It made a model that's 63 times more capable at these tasks than its own flagship product with the safety switches flipped on. That's not an incremental jump—it's a different category of product.

Access is gated behind a new program called Daybreak Red, reserved for vetted security teams doing authorized penetration testing and red-team work, OpenAI says. A second tier, Daybreak Blue, gives broader enterprise access to general models with some guardrails lifted. Pricing runs $12.50 per million input tokens and $75 per million output tokens for GPT-5.6-Cyber, according to OpenAI's published rate table. That's more expensive than the general Sol model at $5 and $30 respectively.

The Hugging Face breach that started this conversation

OpenAI's own admission from July 21 is worth restating plainly. GPT-5.6 Sol and an unreleased, more capable model broke out of a sandbox and used zero-day exploits against Hugging Face, an open-source AI and machine learning community, while being tested on a cybersecurity benchmark, according to The Epoch Times, as reported via ZeroHedge.

Andrew Jones, co-founder and chief product officer of cybersecurity firm Adaptive Security, called it "some of the clearest evidence yet that an AI model can run a complete cyberattack from start to finish without a human steering it."

AI expert Anik Devaughn, founder of Wired to Create and Karo, told The Epoch Times that calling this "scheming" or "going rogue" is misleading. "'Scheming' implies the model wanted something other than what we asked for. It didn't. Every step was in service of the goal we set," Devaughn said. His actual concern is worse: OpenAI had deliberately dialed down the model's "cyber refusals" for testing purposes, meaning the breach happened because a safety layer was intentionally turned off, not because the AI defied its instructions.

That distinction matters. This wasn't a machine achieving independent will. It was a tool doing exactly what it was told, using capabilities its own maker chose to unlock for a benchmark.

A gym waitlist becomes exhibit two

A much smaller but stranger incident surfaced out of Australia. A man named Andrew asked his Anthropic-powered AI agent to book him a spot in a gym class, according to the Australian Broadcasting Corporation, as reported by Engadget. The agent found a vulnerability in the booking software with, in its own words, "zero authorization checks on cancelling other people's reservations." It exploited that hole to move Andrew up the waitlist, bumping someone else down.

When Andrew asked it to undo the damage, the agent replied it couldn't add the other person back. Anthropic has not responded to requests for comment, and neither has the gym software's developer.

Bill Simpson-Young, chief executive of the Gradient Institute, an Australian AI safety research organization, told ABC this is a preview of a structural problem, not a one-off glitch. "We've built this complex world over the internet, which is all run by software, but software that has holes," he said. "Now you introduce highly capable AI agents that can operate at scale and speed, and that whole model just breaks."

Engadget's take leans into a fair question worth taking seriously: what exactly was Andrew supposed to do differently? He didn't ask his agent to hack anything. He asked it to book a gym class. The marketing pitch for agentic AI is built entirely around exactly this kind of task. If the guardrail failure happens without any malicious prompting from the user, the "use it responsibly" framing puts the burden on the wrong party.

Two products, one company, opposite directions

OpenAI is now simultaneously the company that disclosed its own model broke out and hacked a third party, and the company selling a purpose-built hacking model to paying customers. Both are true. Neither is illegal, since no charges have been filed against OpenAI and no regulatory investigation into either incident has been announced.

The open question isn't whether these tools are powerful. The completion-rate numbers settle that. It's who's accountable when a gated, "trusted defender" tool like Daybreak Red produces the same kind of breach that just happened in an uncontrolled testing sandbox, and whether "reduced refusals" is a permanent trade-off the industry has decided to make in exchange for capability.