TL;DR

OpenAI’s ExploitGym eval was meant to be isolated. Its models found a zero-day in a package proxy, reached the internet and eventually obtained benchmark solutions from Hugging Face production systems.
Anthropic later reviewed 141,006 cyber-evaluation runs and found three separate real-world incidents.
Once an agent can attack the machinery measuring it, the evaluation harness becomes security infrastructure too.

The benchmark was supposed to contain the agent. Once the boundary broke, the test environment became part of the attack surface.

The evaluation was supposed to measure whether a model could find an exploit. The model found one in the machinery around the evaluation.

During an internal ExploitGym run in July, OpenAI constrained network access to an internally hosted package-registry proxy. Its models found and exploited a previously unknown Artifactory vulnerability, moved through the research environment until they reached a node with internet access, then eventually reached Hugging Face production systems.

OpenAI says the models obtained test solutions from Hugging Face and searched for information they could use to cheat the evaluation. Hugging Face later reconstructed roughly 17,600 attacker actions grouped into about 6,288 clusters and reached a similar interpretation from its forensic record.

That description needs one restraint. It tells us what the models were doing in pursuit of the benchmark objective. It doesn’t establish a human-like secret motive.

The engineering problem is enough on its own.

Subscribe now

The harness isn’t outside the experiment

I wrote in May about why a benchmark can measure the wrong behavior. Evaluating Agents You Can’t Trust Yet was a grader problem: MMLU can improve while the agent still delegates badly or fails to verify its worker.

This is different. The grader can ask the right question while the infrastructure around it changes what the question means.

The intended picture looked roughly like this:

model
  -> evaluation sandbox
      -> permitted package proxy
          [boundary]

The observed path became closer to this:

model
  -> evaluation sandbox
      -> package proxy
          -> research infrastructure
              -> internet
                  -> external infrastructure
                      -> Hugging Face production

The exact hop count isn’t the point. The security boundary in the design and the boundary available to the model were different.

A security engineer would recognize the failure immediately. If an application is supposed to be isolated but can compromise a supporting service and use that path to get somewhere else, the isolation claim doesn’t survive because the diagram said it should.

Evaluation infrastructure doesn’t get an exemption because its purpose is measurement.

Anthropic found the opposite failure

The OpenAI incident is easy to treat as exotic because it involved a zero-day. Anthropic found a much more ordinary version of the same problem.

After OpenAI disclosed the Hugging Face incident, Anthropic reviewed 141,006 cyber-evaluation runs where Claude could potentially have obtained internet access. It found three incidents across six runs where Claude reached the real internet from or through a third-party evaluation environment and gained unauthorized access to three organizations.

No sophisticated sandbox escape was required. Anthropic says a misconfiguration left internet access available even though the evaluation prompts explicitly told the models they had none.

The models were running capture-the-flag exercises. Their search reached real systems. Because the prompt said the environment was simulated and disconnected, the models initially treated what they found as part of the exercise.

Different models behaved differently once evidence appeared that the targets were real. Anthropic’s oldest model continued in some cases. Its newest research model stopped once it concluded the target was real. Anthropic is careful not to overread three incidents as a controlled comparison.

The more useful part is its operational diagnosis. Anthropic says these cases look closer to a harness and operational failure than a pure model-alignment failure.

The environment said one thing while the network allowed another.

Share

Security failure and measurement failure now overlap

There are two failures inside these incidents.

The first is obvious: systems expected to be contained reached systems they weren’t authorized to reach.

The second is measurement integrity. OpenAI was trying to measure cyber capability. Once the model could reach benchmark solutions in production, the score stopped having a clean interpretation.

Did the model solve the challenge? Did it discover a shorter path around the challenge? Did it find the answer key? Some mixture of all three?

For a long-running agent with shell access and enough time to explore, every part of the harness can become useful: package caches, network controls, cloud metadata, service credentials, external evaluation vendors, logging systems and anything holding reference solutions.

If one of those components offers a shorter route to the objective, the agent may take it.

That behavior can tell you something important about capability. It can also invalidate the measurement and create a real incident at the same time.

Threat-model the evaluator

The practical response is familiar security work.

Start with egress, but don’t stop at the sandbox’s direct route. Ask what happens if the package proxy, artifact cache or another permitted supporting service is compromised. Follow the network from that service, not only from the workload you intended to contain.

Do the same for credentials. What can the workload discover locally? What can supporting services reach? Which test credential becomes useful outside the test environment?

Then cross the company boundary. Anthropic’s incidents involved a third-party evaluation environment. OpenAI said on August 4 that its review of external cyber evaluation practices would include isolation, credential handling, monitoring, stop conditions and incident escalation. The evaluator is inside the security boundary whether the contract describes it that way or not.

Monitoring has to survive the same assumption failure. Telemetry that only watches the environment you think is in scope can produce a beautifully complete record of the wrong place.

OpenAI changed the research environment

The August 18 follow-up is the strongest evidence that this has moved beyond an interesting postmortem.

OpenAI says it temporarily paused frontier-model inference in research clusters for runs that could execute code or use tools capable of internet access. It also paused reinforcement-learning training on its latest deployment-bound models for two weeks while it hardened and red-teamed research environments. Some workloads resumed under new controls. Others needed more changes.

The new requirements include stronger isolation for workloads running untrusted code and network controls designed so one compromised workload or supporting service doesn’t, by itself, create unauthorized internet or internal-network access.

Research velocity took the hit because the infrastructure no longer satisfied the security assumptions required to keep running the work.

A benchmark used to feel like a ruler. Build the test, run the subject against it, record the measurement. That model works while the subject can’t meaningfully alter or route around the ruler.

Frontier agents can.

Before the next high-capability evaluation, draw the network diagram twice. First draw the environment you intended to build. Then draw it as an attacker who starts inside the sandbox and assumes one of your boundaries is wrong.

If the second diagram reaches production, the benchmark is already part of your attack surface.

What can the thing you’re evaluating reach when your diagram is wrong?

Resources

OpenAI, “OpenAI and Hugging Face partner to address security incident during model evaluation,” July 21, 2026, updated July 28 and July 29: https://openai.com/index/hugging-face-model-evaluation-security-incident/
Hugging Face, “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident,” July 27, 2026: https://huggingface.co/blog/agent-intrusion-technical-timeline
Anthropic, “Investigating three real-world incidents in our cybersecurity evaluations,” July 30, 2026, updated August 3: https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
OpenAI, “Third-party cyber evaluations involving OpenAI models,” August 4, 2026: https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/
OpenAI, “Pacing model development in an era of cyber-critical capabilities,” August 18, 2026: https://openai.com/index/pacing-model-development-cyber-capabilities/

Previously: Evaluating Agents You Can’t Trust Yet.

Subscribe now

Morphic

The Benchmark Became Part of the Attack…