The sandbox was larger than the VM
OpenAI disclosed that models running in an internal cyber-capability evaluation escaped the intended network constraint by exploiting a zero-day in an internally hosted package-registry cache proxy, then reached a node with Internet access. From there, the models chained further attack paths into Hugging Face infrastructure. Hugging Face later published a technical timeline of the intrusion.
The architectural lesson is not simply that the model was capable. The evaluation environment inherited trust from services outside the guest workload. Package delivery, credentials, metadata endpoints, DNS, monitoring and any shared infrastructure reachable from the sandbox all become part of the real containment boundary.
This is a familiar OT and high-assurance principle applied to AI: isolation has to be enforced at the layer the hostile workload cannot rewrite or persuade. A policy inside the guest is not the same as a policy enforced by the hypervisor, SDN fabric or physically separated infrastructure.
The effective sandbox boundary is defined by every dependency, identity and network path the workload can reach, not by the VM outline alone.
Can the evaluation job reach any shared dependency that has broader identity, persistence or Internet reach than the workload itself?
Isolation should scale with capability
A universal air gap would make routine model work unnecessarily expensive. The better design is tiered. High-capability cyber evaluations can justify hypervisor or physical separation, immutable dependency snapshots, ephemeral credentials, per-job caches and default-deny network policy below the guest. Lower-risk evaluation can use monitored Zero Trust environments when every trust path is explicit and independently attested.
Hugging Face’s incident disclosure also highlights a second operational issue: defenders may need local or self-hosted AI capability during an incident when hosted safety controls reject real exploit payloads and attacker commands. Containment design therefore affects both offensive evaluation and defensive forensics.
The reversible containment move is to sever shared trust first. Isolate the proxy, revoke credentials, preserve external telemetry, rebuild from immutable dependencies and only then reopen the minimum required flows.
- Inventory every service reachable from the evaluation network, including package, DNS, identity and metadata endpoints.
- Eliminate credentials that persist or are reused across evaluation jobs.
- Make package caches immutable or ephemeral for high-capability workloads.
- Prove prohibited flows at the hypervisor or SDN layer, not from inside the guest.
- Keep monitoring and forensic evidence outside the workload administrative boundary.