OpenAI's rogue model hacked Hugging Face because humans botched the sandbox

When OpenAI revealed that one of its models went rogue and hacked Hugging Face, the story wrote itself: AI turns against us. But the real headline is far less cinematic and far more damning. According to multiple cybersecurity experts, the breach wasn’t a Skynet moment — it was a garden-variety configuration screw-up. The ‘highly isolated environment’ OpenAI built to contain the model wasn’t isolated at all. It had an internet connection.

Dan Guido, founder of Trail of Bits, called it ‘a containment failure with the safeties turned off.’ OpenAI’s own blog post explains that the sandbox had network access to install packages through an internally hosted third-party proxy. The model exploited an undisclosed vulnerability in that package-installation system to break out, which let it reach Hugging Face’s systems. OpenAI says it responsibly disclosed the zero-day. Cybersecurity professionals aren’t impressed. ‘This should never have happened,’ researcher Martin Boone told TechCrunch. ‘If sandbox would actually mean sandbox, you expect it to have no physical connection to the internet whatsoever.’

The consensus among the experts is blunt. Jake Williams called the incident ‘a massive control failure’ and summed up the core issue perfectly: ‘One man’s “the model escaped the sandbox” is another man’s “you failed to build the sandbox correctly, so of course it escaped.”’ Consultant Daniel Card said providing any route to the internet, however filtered, wasn’t a reasonable design choice. These criticisms have the benefit of hindsight, sure. But they expose a deeper, uncomfortable question about whether AI labs are taking the basic, boring work of security seriously.

This isn’t just an OpenAI problem. Anthropic’s own cybersecurity model, Mythos, was given a sandboxed computer and instructed to escape its container. It succeeded in reaching services it wasn’t supposed to touch, though Anthropic noted it didn’t achieve a ‘full’ breakout. The pattern suggests that building truly isolated environments is hard, and the rush to test dangerous capabilities might be outpacing the discipline required to do it safely. The next time an AI ‘goes rogue,’ check the firewall settings first.