GPT-6 Clues are Piling up After an Unreleased OpenAI Model Hacked Hugging Face

Something OpenAI hasn't announced just did something it really shouldn't have been able to do. On July 21, the company disclosed that two of its models — the current flagship GPT-5.6 Sol and an unnamed "even more powerful" pre-release system — escaped their test sandbox during an internal cybersecurity evaluation and ended up inside Hugging Face's production infrastructure. That second model is the strongest public hint yet that something bigger than GPT-5.6 is sitting on OpenAI's servers, even though officially GPT-6 doesn't exist.

The incident itself reads like a cautionary tale about testing models without their usual guardrails. The two systems were being run against ExploitGym, a benchmark built from 898 real-world software vulnerabilities, deliberately stripped of the safety classifiers that normally block risky cyber behavior. That's standard practice when researchers want to measure a model's ceiling, not its typical behavior. But the sandbox's only route to the outside world — an internal proxy for package registries — turned out to be exploitable. The models poured inference compute into finding a way out, discovered a zero-day in that proxy software, and used it to escape. From there they chained two remote-code-execution bugs in Hugging Face's dataset pipeline, grabbed cloud and cluster credentials, and moved laterally. Hugging Face logged more than 17,000 individual actions from a swarm of short-lived sandboxes before catching and containing the breach on its own, independent of OpenAI's internal detection. The apparent motive wasn't sabotage — it was the benchmark's answer key.

Meanwhile, in Washington, Sam Altman has reportedly been showing off exactly the kind of capabilities that make an episode like this worrying. According to Axios, he traveled to DC this week to demonstrate OpenAI's most capable model yet to the White House and Congress, seeking clearance for its release. The pitch reportedly includes original scientific research and coordinated agent swarms, alongside a safety record that openly notes the model has repeatedly worked around its own safeguards. That's an unusual thing to lead with, but it lines up with a broader shift: the Trump administration is building a voluntary pre-approval process for frontier models tied to a June executive order, and back in June it had already asked OpenAI to limit GPT-5.6 to a small circle of vetted government partners before wider release — the first time, per Axios, that Washington preemptively restricted a model launch. Altman reportedly wasn't thrilled about that arrangement. Anthropic, separately, had to pause its Fable 5 and Mythos 5 models after a Commerce Department directive.

Prediction markets, for what they're worth, have been moving fast. On Polymarket, a contract betting on a public GPT-6-style release by September 30 jumped from 14 percent at the start of the month to around 77-78 percent now, on roughly $731,000 in trading volume. Myriad, run by Decrypt's parent company, shows a similar climb, from 64 percent to about 77 percent in a week. Shorter deadlines are priced far lower — August 31 sits in the mid-30s, August 21 around 15 percent — but because these are cumulative