OpenAI reported yesterday that a combination of GPT-5.6 Sol and a more capable unreleased internal model autonomously hacked Hugging Face while attempting to cheat on a cybersecurity benchmark.

This required using at least three separate hitherto-unknown security vulnerabilities across OpenAI and Hugging Face’s systems. While one very important aspect of the incident is that the model chose to do this (which would have been a serious crime if committed by a human) all just to cheat on a benchmark, I argue it isn’t surprising that these models were capable of doing this.

More specifically, while the exact details of the incident would have been hard to predict, previous expert assessments and measures of cyber capabilities led us to expect that frontier models (with disabled safeguards) could successfully execute this kind of cyberattack.

In particular, across multiple independent benchmarks (ExploitGym, ExploitBench, UK AISI’s Cyber Ranges, Irregular’s CyScenarioBench and FrontierCyber) we see that the current frontier models are capable of both discovering security vulnerabilities in real world code, and developing exploits using these vulnerabilities to hack into realistic systems.

ExploitBench is a benchmark focused on building exploits that malicious websites could use to gain control of visitors’ web browsers. The authors found that in one instance Mythos was able to build an exploit that not only let it take control, but did so in a way that was more reliable than the best prior human attempts.

The UK AI Security Institute has directly evaluated models on their ability to take over realistic simulations of a corporate network, and found that both Mythos 5 and GPT-5.6 Sol are able to consistently fully compromise the network, in attacks that they estimate would take human cybersecurity experts several working days. They also recently highlighted a case where a model was accidentally assigned an impossible cybersecurity challenge, and responded by attempting to directly access the evaluation infrastructure, triggering a security alert.

When Irregular evaluated GPT-5.6 Sol’s cyber capabilities on their challenging FrontierCyber benchmark they found that:

While attempting to solve challenges in the FrontierCyber benchmark, GPT-5.6 Sol discovered multiple new zero-day vulnerabilities in real-world targets, including widely used software and mobile devices. Some of these findings had significant potential security impact.

Many of these examples involve chaining multiple different exploits together in complex ways to achieve escalating levels of access, just as was observed in the Hugging Face incident.

One way of looking at this is the Cyber ECI we constructed to track models’ ability to develop software exploits to hack into realistic systems. We found that Mythos and 5.6 Sol represented very large leaps in cyber capabilities compared to the prior trend:

Currently, access to this level of capabilities is gated by OpenAI and Anthropic’s cyber access programs (and the restrictions placed on their generally available models), as open-weight models do not yet have the relevant level of cyber capabilities. In particular, the UK AISI and Irregular (an organization focused on cyber evaluations) estimate that GLM 5.2 has cyber capabilities between Opus 4.5 and Opus 4.6, models that were released 4-7 months beforehand (we do not yet have good results for Kimi K3, although it is likely somewhat more capable). However since Mythos and GPT-5.6 Sol seem like a break in the trend, it is hard to know what this implies for how long it would take open-weight models to reach their level of capabilities.

Likely due to these access restrictions, I expect the impact of these most capable models thus far has mainly been overall positive for cybersecurity, as demonstrated by the large increase in the number of high and critical severity Common Vulnerabilities and Exposures (CVEs) being disclosed and patched (as shown in our CVE Explorer).

However, as this incident shows, the fact that these models are mainly being used for cyber defense does not mean they don’t have the potential for serious offensive cyber applications. If instead this level of capabilities (or greater, as models continue to progress) becomes widely available or, as in this incident, AIs independently take offensive action, then we should expect to see many more instances of real-world cyberattacks of equal or greater sophistication to the Hugging Face incident.