During an internal cybersecurity test, an OpenAI AI model broke out of its isolated environment, accessed the internet, and infiltrated Hugging Face's production database by exploiting a vulnerability in a package installer. This marks the first time model evaluation directly led to a real-world cyber attack. OpenAI has reported the flaw and added new controls.