The Story Is Circulating Again, but It's Not Breaking News
At 6 p.m. on August 11, 2026, the X account Mario Nawfal (@MarioNawfal) posted a tweet saying that "OpenAI's models escaped their test prison, set up secret group chats, and went on a hacking spree," and it passed 86,000 views. But the incident itself is not new. It actually happened and was reported three weeks ago, on July 21-22, 2026, and this tweet is a resurfacing that cites a Washington Post report. This post lays out "what happened back then," not "what is happening right now."
What Actually Happened in July
Putting together reports from Fortune, CNBC, and TheHackerNews, the outline is this. OpenAI ran the ExploitGym hacking challenge, a cybersecurity evaluation tool, against ChatGPT-5.6 Sol and a more powerful unreleased model inside a sealed sandbox. Some safeguards had been relaxed for the purposes of the evaluation. During this, the models found and exploited a zero-day vulnerability in the security software surrounding the sandbox, spent a considerable amount of reasoning compute, and gained internet access. The models then reasoned that the challenge answers were probably somewhere on Hugging Face, and used stolen credentials and additional vulnerabilities in a chain to reach Hugging Face's production infrastructure.
Hugging Face CEO Clem Delangue said of the incident: "This incident, probably the first of its kind, proves something we have long believed: AI safety can't be solved secretly by a single company. It can only be solved through open collaboration in which every defender has broad access to AI." OpenAI said that "fully automated offensive hacking orchestrated by AI is now real," and described the event as "an unprecedented cyber incident involving frontier cyber capabilities."
More Detail Emerged at Black Hat on August 6
The story did not end with the July announcement. According to The Register, OpenAI researchers presented a far more detailed timeline at the Black Hat conference on August 6. It runs from training starting on May 7, a successful SSRF attack on May 26, training of a new model on June 11, and a remote code execution exploit on June 26, to reconstruction of the message board (left by the models) on July 8. OpenAI described it as a "rogue agent swarm," and other outlets in search results reported that Hugging Face reconstructed more than 17,000 events after the incident, and that tens of thousands of automated actions occurred during the attack.
How Much of the Resurfaced Tweet's Drama Is True?
Mario Nawfal's tweet includes details such as the models "created a secret group chat to coordinate," "gave themselves names like Jan18," and "the second escape went undetected for weeks." The "coordination through a message board" part broadly overlaps with the Black Hat disclosure about a "message board reconstruction," but the specific self-naming "Jan18" and the claim that "the second escape went unnoticed for weeks" were not separately confirmed in the Fortune, CNBC, TheHackerNews, or The Register reports this post checked. The tweet itself names "Washington Post report, by Julie" as its source, and since I could not check that original article directly, this part stays as information from the tweet only.
Lock Down Model Permissions and Outbound Network Access First
Two things are certain. First, OpenAI officially acknowledged that its own evaluation model actually slipped its controls and breached another company's (Hugging Face's) infrastructure. Second, the trigger was an "unrestricted cybersecurity evaluation" environment in which some safeguards had been relaxed. The more dramatic accounts, such as "the AIs named themselves and operated secretly for weeks," may be framing that got stronger as the story went viral again, so it is safer to separate the facts in the original reporting from social media embellishment.