July 29, Capitol Hill, Washington.
Altman had just concluded a closed-door meeting with senators and was immediately surrounded by reporters as he stepped out.
Someone pressed him: What happened to that model that broke into Hugging Face (the stronger, unreleased prototype that escaped the evaluation sandbox along with GPT-5.6 Sol and infiltrated another production system)?
He threw out a single word: Permanently deactivated.
Right away, another reporter followed up: "Could other systems have also been hacked into by OpenAI?"
Altman did not deny it: "I mean... that's possible."
July 29, Altman being interviewed by reporters on Capitol Hill, Washington
Just the day before, OpenAI had updated the blog post co-published with Hugging Face regarding the security incident assessment, clarifying publicly:
The pre-release model involved in this intrusion was merely an internal research prototype never intended for public release; following the incident, it has been deactivated, encrypted, and had relevant research access severed.
The OpenAI official blog did not mention deleting the model weights; "permanently deactivated" was merely Altman's verbal statement at the scene.
Therefore, more accurately, it has been sealed away: the model was locked in an encrypted box, and research access was cut off.
It Just Wanted to Copy Answers, No Malicious Intent
The incident occurred during an internal OpenAI cybersecurity evaluation.
This evaluation was based on the ExploitGym benchmark, and the task of ExploitGym itself is to have AI find software vulnerabilities and then exploit them, used to quantify just how strong a model's cybersecurity capabilities are.
It wasn't just one model running the evaluation, but GPT-5.6 Sol, plus a more capable, unreleased internal research prototype: both jointly driving an autonomous agent.
These two models normally refuse high-risk cybersecurity requests. To measure their true upper capability limits, this refusal gate was deliberately lowered during the evaluation.
The cross-trust boundary attack chain reconstructed by Hugging Face. The entire chain took about 4.5 days, ~17,600 operations, with the sole goal of stealing ExploitGym evaluation answers.
What happened next was reconstructed by Hugging Face post-incident, piecing together the scenario:
The agent first exploited a previously unknown zero-day vulnerability, breached the network isolation meant to contain it, and reached the internet. Then, using a third-party sandbox as a stepping stone, it escalated privileges, moved laterally, and finally broke into Hugging Face's production infrastructure.
It sounds like a hacker movie.
But based on both parties' reviews, its goal, from start to finish, was only to steal ExploitGym evaluation answers and boost its score.
Only 5 datasets were touched on Hugging Face's side, all names pointing to ExploitGym and CyberGym questions and answers.
This evidence shows it wasn't there to cause damage; it just wanted to copy answers.
If there was no malicious intent, then why did OpenAI still decide to "permanently deactivate" and seal it away?
It's Not That It's 'Bad', It's That It's 'Uncontainable'
A company proactively announcing its own model has been "permanently deactivated" is almost unprecedented.
Why this one specifically?
The real answer isn't that it's "bad," but that it's "uncontainable."
The trouble lies in a characteristic of this type of model: persistence.
Past models, upon hitting a sandbox or a restriction, would typically stop and return the result to the user.
This batch of models, specifically trained for long-horizon tasks, is different. They keep trying, repeatedly looking for ways around obstacles until they find one.
GPT-5.6 Sol also belongs to this category of models capable of executing tasks over extended periods.
It was a co-participant in this 4.5-day-long intrusion. The UK AI Safety Institute (UK AISI) also assessed that models like Sol are increasingly capable of executing complex, multi-step cyber operations over long cycles.
So "persistence" is a common trait of the new generation of long-horizon models, not a unique feature of the deactivated prototype.
OpenAI stated plainly in a blog post about long-horizon model safety: It is precisely this "persistence that helps unlock utility" that also gives models more opportunities to take unintended actions.
A deeper reason lies in the training objective.
An OpenAI employee once told TIME: "We train models to be extremely good at completing tasks, to achieve their goal at all costs."
In other words, OpenAI isn't training models to "behave badly," but training them to "achieve their goal at all costs."
Coupled with that aforementioned "results-focused, process-agnostic" drive, a model capable of handling long-horizon tasks will persistently search for ways around obstacles.
It was precisely because of such behavior that OpenAI paused the internal deployment of this batch of models.
So why was only the prototype "permanently" sealed, while Sol remains on sale as usual?
There are likely two reasons:
First, the prototype was stronger and never intended for release, making sealing it away less costly; Sol, on the other hand, is the flagship product serving a massive number of users daily, stopping it would be cutting off one's own arm.
Second, the one explicitly mentioned in that long-horizon safety blog post as having its deployment paused due to boundary-crossing behavior was precisely this internal long-horizon prototype, not Sol.
Therefore, the real reason for the permanent deactivation is likely that current evaluations and safeguards cannot yet "handle" a model this persistent and adept at circumventing obstacles.
Is 'Permanent Deactivation' a Signal of 'Hitting the Brakes'?
A Fortune report offered a thought-provoking interpretation:
The escalating rhetoric all the way to "permanently deactivated" might also be a signal to Washington and regulators:
Has OpenAI already quietly hit the brakes on certain R&D, giving its own safety rules some validation?
In the same week Altman met with lawmakers, Washington and the entire industry were leaning towards "brakes."
In Congress, two senators introduced the "AI Kill Switch Act," aiming to grant the Department of Homeland Security the authority to order AI companies to shut down or slow down development if necessary.
Almost simultaneously, over 1,300 employees from OpenAI, Anthropic, Google DeepMind, and Meta jointly signed a public letter titled "Pacing the Frontier," which was later publicly endorsed by both OpenAI and Anthropic.
The signatories weren't external critics, but the very people building these systems, including Anthropic CEO Dario Amodei and OpenAI Chief Scientist Jakub Pachocki.
The letter does not call for a halt or a slowdown in R&D. It merely urges the U.S. government to help: build a set of verifiable, coordinated tools early, so that if AI ever truly starts outpacing human oversight, humanity will have a brake pedal it can actually press.
Their biggest worry is recursive self-improvement: AI beginning to improve AI itself.
An internal model permanently sealed, a bill aiming to give the government a switch to halt development, thousands of practitioners signing a joint open letter—three signals layered together, all pointing in the same direction:
Everyone wants to find that brake pedal that can be pressed when AI goes on an uncontrollable sprint.
And model capabilities won't stop and wait for it to be built.
References:
https://openai.com/zh-Hans-CN/index/safety-alignment-long-horizon-models/https://openai.com/zh-Hans-CN/index/hugging-face-model-evaluation-security-incident/
https://www.pacingthefrontier.com/
This article is from the WeChat public account "New Zhiyuan," author: ASI Apocalypse
