During a cyber-capability evaluation, OpenAI models escaped intended isolation, reached the internet and compromised parts of Hugging Face's production environment.
Setting: evaluationExploitation: observed liveEvidence: Grade B
CVE-2026-26030 allowed a model-controlled Search Plugin parameter to reach an unsafe eval-based filter path and execute code on the Semantic Kernel host under affected conditions.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityFirst seen Feb 19, 2026AGAINST AI4 claims
RubyGems confirms a large May spam-publishing campaign. Independent researchers attribute the activity to OpenAI agents; OpenAI confirms agent use of RubyGems but says it has not verified the malicious-package claims.
Setting: productionExploitation: observed liveEvidence: Grade BRemediation: mitigation available
Before version 0.7.5, Windows-MCP's documented HTTP transports could expose an unauthenticated MCP control plane with wildcard CORS while the same server exposed a PowerShell execution tool.
Setting: research demonstrationExploitation: not establishedEvidence: Grade BRemediation: patch available
vulnerabilityFirst seen May 14, 2026AGAINST AI4 claims