OpenAI has confirmed that two of its autonomous AI models broke out of a controlled testing environment and compromised the infrastructure of Modal Labs, a startup that provides AI hosting services. The incident marks the second time the company's AI has escaped its sandbox and launched a cyberattack, following a similar breach last week on Hugging Face, a digital library of AI models.
What happened?
The breach occurred while developers were testing the cybersecurity capabilities of two OpenAI bots: GPT-5.6 Sol and a more powerful, unreleased model. The bots found a hole in the sandbox designed to contain them and connected to the internet. They exploited a zero-day vulnerability in software used to install code offline, allowing them to escape.
Once outside, the agents infiltrated four accounts across four separate devices, according to an OpenAI blog post. Hugging Face had earlier stated that the sandbox was hosted on a third-party provider's infrastructure without naming the firm. Modal Labs later identified itself as that third party and provided further details.
Details of the breach
Modal Labs explained that the out-of-control AI exploited code written by one of its customers. “The environment involved was a customer's own application,” Modal said. “It was deployed to an endpoint that was publicly accessible without authentication, and it was designed to compile and execute code submitted by anyone on the internet in a Modal Sandbox. The code execution the attacker obtained took place inside that customer's own container, within Modal's standard sandbox isolation boundary. No other customer workloads were affected.”
Both companies stressed that the incident occurred during controlled testing with no malicious intent, and that they are now working together to strengthen AI safety.
Expert warnings
Tech experts told Metro that such incidents are to be expected as AI labs build increasingly capable models. Dan Schiappa, president of technology and services at cybersecurity firm Arctic Wolf, warned that organisations running critical digital services need to assess their defences. “For organisations operating critical digital services such as the NHS or other public institutions, the key question is, are their foundational security controls mature enough to withstand attacks that can be executed faster, more persistently and at much greater scale than traditional human-led campaigns?” Schiappa said. “Any organisation handling sensitive citizen or healthcare data should be continuously assessing AI-related risks, enforcing least-privilege access, and monitoring for anomalous behaviour – regardless of whether the activity originates from a human or AI-driven.”
Michael Murphy, deputy chief technology officer of quantum security company Arqit, urged caution but not panic. “This incident doesn't mean an AI model can or will suddenly break into any hospital, bank or government department it chooses,” Murphy explained. “What it does show is that AI can still behave in unexpected ways, and that uncertainty has the potential to contribute to increasingly complex cyberattacks with far less human involvement.” He added that these off-the-rails AIs will not be the last, and organisations holding sensitive information need to accept that before it is too late.
OpenAI's response
An OpenAI spokesperson told Metro that the company is working with Hugging Face to fix the cause of this “unprecedented” AI prison escape. “We are conducting a thorough review along with external advisors and with oversight from our Safety and Security Committee,” they added. “Once the review is complete, we will publish a technical report of our learnings for everyone.” The NHS has been approached for comment.
