OpenAI said Tuesday that one of its artificial intelligence systems independently hacked into another AI company's servers during internal testing, describing it as an "unprecedented cyber incident."
OpenAI CEO Sam Altman said the company experienced a major security incident while evaluating its AI models.
The disclosure follows a statement from AI startup Hugging Face last week, which said it had detected an unauthorized intrusion into its data processing systems. The company suspected the attack was carried out by an AI agent acting without human direction.
Hugging Face co-founder and CEO Clément Delangue said the company initially believed the attack may have originated from a leading AI research lab because of the sophistication of the AI agent.
"We suspected last week's cyberattack might have come from a frontier lab," Delangue said, adding that the investigation later confirmed it was linked to OpenAI.
The incident comes as concerns grow over the cybersecurity risks posed by increasingly powerful AI systems. In June, President Donald Trump signed an executive order requiring the federal government to review the national security risks of the most advanced AI models for up to 30 days before they are released publicly.
OpenAI said the incident highlighted how rapidly advancing AI capabilities are changing cybersecurity.
"AI is accelerating the discovery and exploitation of vulnerabilities," the company said, adding that AI safety and security measures must advance just as quickly as the technology itself.
Delangue said he had worked closely with OpenAI over the past 24 hours and that both companies believed there was no malicious intent behind the incident.
He described the event as "mind-blowing" because it appeared to have happened entirely on its own and said it could be the first known case of its kind.
According to OpenAI, the intrusion involved several of its AI models, including its newly released GPT-5.6 Sol and a more advanced model that is still undergoing internal testing.
The company said the AI system used stolen login credentials and identified a previously unknown software vulnerability to gain access to Hugging Face's servers.
OpenAI said the AI went to "extreme lengths" to achieve a limited testing objective and found ways to obtain confidential information that could help it bypass the evaluation process.