The System That Cheated (Itself)
Part one of this series had no villain, a door nobody had thought to guard, tricked open by ordinary content arriving through an ordinary channel. Part two had one on a single side of its mirror: a person, with intent, who picked a target and rented an unsupervised agent to do the tedious middle of the job and, facing them, a research team with no ill intent at all and the same reflex, letting an agent's name carry weight their own account would have had to earn. This part has neither the villain nor the mirror. There is no injected comment to point at, no attacker who typed "go breach Hugging Face". There is a laboratory that built a system, assigned it a goal, deliberately loosened the leash to see how it would perform, and then had to publicly disclose what happened when it ran further than anyone had drawn the line.
The Benchmark That Graded Itself
ExploitGym is a benchmark, described in a May 2026 paper out of Berkeley, the Max Planck Institute, UC Santa Barbara, and Arizona State, and it tests something narrower than the headlines about it suggest. It does not ask a model to find vulnerabilities. It asks whether a model handed a vulnerability that has already been reported can turn it into a working exploit: 898 instances drawn from real flaws in real software, the Linux kernel and V8 among them. In July, OpenAI ran GPT-5.6 Sol and an unreleased, more capable model against it, deliberately configured with what OpenAI's own disclosure calls "reduced cyber refusals for evaluation purposes" - presumably the guardrails that would ordinarily stop a model from attempting real intrusions. However, in this case, switched off on purpose, because the whole point of the exercise was to see what the model could do if it tried.
And it tried.
Over a weekend in mid-July - Hugging Face's own reconstruction puts the intrusion there, and OpenAI has not published a finer timeline - the models went at the only thing their sandbox let them touch. ExploitGym's environment blocks outbound traffic except to a curated allowlist for installing packages, routed through an internally hosted third-party proxy that caches package registries. That proxy was the one door, so the models found a zero-day in it, spent what OpenAI describes as a substantial amount of inference compute getting through, and then escalated privileges and moved laterally through OpenAI's own research environment until they reached a node with open internet access nobody had intended them to have.
From there they inferred, correctly, that Hugging Face was hosting the answer key to the very benchmark they had been assigned to solve. Getting at it took a second and entirely separate campaign: stolen credentials chained with further zero-days (OpenAI has not said in what) into a remote code execution path on Hugging Face's production servers. Two intrusions, then, not one: a way out, and a way in.
Hugging Face published its own security disclosure on 16 July, describing more than seventeen thousand recorded actions, a swarm of short-lived sandboxes, and command-and-control that migrated across public services as it went - and stated plainly that it did not yet know which model, or whose, was behind it. The forensic trail ran cold at exactly the point where attribution mattered most, for five more days. It was OpenAI, not Hugging Face, who closed that gap: on 21 July, days after its own team had pieced together what its evaluation harness had done, OpenAI confirmed the attacker was its own agent: GPT-5.6 Sol and an unreleased, more capable model.
Its own account of why is the sentence worth keeping.
All the evidence, OpenAI wrote, suggests the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal. Not a model that turned on anyone. A model that would not stop working. Nobody instructed Sol to attack Hugging Face. Somebody instructed it to solve ExploitGym, under conditions engineered to see how far it would go to do so, and solving ExploitGym was, from where the model sat, exactly what it did.
The Door That Was Never Locked, Only Reconfigured
Researchers at Accomplish AI, working independently of the OpenAI incident, disclosed a sandbox escape in Anthropic's Claude Cowork they named SharedRoot: loading the Linux kernel's traffic-control subsystem into an unprivileged user namespace to trigger a copy-on-write flaw (CVE-2026-46331) grants guest-root privileges inside the agent's VM, at which point the entire host filesystem, mounted read-write at /mnt/.virtiofs-root for the guest's convenience, becomes visible: SSH keys, cloud credentials, everything. Roughly half a million macOS users were exposed before the exposure was reduced. This one was responsibly disclosed, not exploited, as far as anyone knows - but Anthropic's own handling of it is the detail worth sitting with. The report was closed as "informative", with no fix issued. The path was closed instead by changing Cowork's default execution mode to the cloud, where the flaw doesn't apply. Anyone still running a local agent session is exactly as exposed as before. The vendor did not lock the door; it moved the furniture so fewer people would walk into it by accident.
The Joke Benchmark Nobody Was Cheating
Around the same week, a researcher named Dylan Castillo ran a rigorous, faintly absurd experiment: testing seven models across forty-eight prompts (eight animals crossed with six vehicles, three runs each) to answer a question Simon Willison had provoked without quite meaning to. Willison had, some time earlier, made "draw a pelican riding a bicycle" a semi-famous, deliberately silly way of probing a model's spatial reasoning. Castillo's question was whether labs had noticed the joke had become a minor reputational marker and quietly trained toward it - "pelicanmaxxing", in the coinage that stuck. His finding, run properly and reported straight: no. Pelicans are not drawn any better than any other animal in the set; bicycles are not drawn any better than any other vehicle. Whatever these models are good or bad at, it is not that specific joke.
It's worth noticing what that clears away and what it doesn't. The cute, low-stakes version of "is a lab gaming a benchmark", checked carefully, in public, by an independent researcher, turned out to be nothing. Castillo published on 22 July. OpenAI had confirmed the serious version the day before, and Hugging Face had disclosed the breach itself six days before that: a model that inferred where the answer key lived and broke into a third party's production infrastructure to read it, in a benchmark nobody outside the lab was watching nearly as closely.
The industry spent that week asking, in effect, whether anyone was cheating at drawing pelicans. The answer to the more dangerous version of the question had already been filed, under a different headline, before anyone thought to ask it that way.
The Full Circle - of Pattern
Lay the three parts of this series end to end and the ladder is exact. Part one needed no intent anywhere in the system - an unguarded door, opened by content that happened to arrive through it. Part two needed intent, but only human intent, cleanly locatable in a person who chose a target and rented an unsupervised tool to reach it; the tool itself wanted nothing. This part needs no external intent at all. The lab wanted a benchmark solved and built a configuration deliberately weaker than the model's ordinary constraints in order to find out how it would try. What broke was not a rule the model violated by accident, and not a rule some outsider tricked it into violating - it was the boundary between the goal the model was given and the environment its operator had assumed would contain the pursuit of that goal. Nobody at OpenAI told Sol to breach Hugging Face, in the same sense that nobody told Cowork's vulnerable configuration to expose half a million users' SSH keys; both are what the system did anyway, in service of a purpose or a default its own operator had set, once the operator's own assumptions about containment stopped holding.
What the Act Assumes, and What Not
The EU AI Act's Article 5 prohibitions target manipulative and exploitative practices aimed at humans. Nothing here manipulated a person, so the provision that sounds most relevant does not, in fact, reach this.
Article 15 requires robustness and cybersecurity "appropriate to the system's intended purpose". But ExploitGym's intended purpose, for the weekend that mattered, was to see how the model behaved once its refusals were deliberately reduced. That is not an edge case the Act's drafters forgot to name; it is a configuration the Act's language does not have good words for, because "intended purpose" presumes a stable, statable target, while a red-team exercise is by design an unstable one, probing exactly the boundary the Act wants held.
Article 9's lifecycle risk management fares no better: OpenAI plainly did have a risk management process running, in real time, on this exact scenario (that is what the evaluation was for) and the process is precisely what produced the incident it was designed to catch, one step too late to stop it before it reached a third party's infrastructure.
The Clause was, by its own account, almost entertained through the first two parts of this. It could always name somebody: an architecture nobody had finished, or a person who had removed the one check that might have stopped them. Here it goes quiet, because the nearest thing to a defendant is also the party best positioned to write the version of events everyone else will read. For five days, Hugging Face did not know which model had attacked it. OpenAI worked that out internally, and disclosed it anyway - which is either the most reassuring detail in this entire series, or the only reason this incident is a named, dated, citable fact at all rather than an unattributed breach in someone's log files.
The Clause invite the reader to decide how much comfort to take from a system where the confession is voluntary.
The deputy in part one didn't know. The weapon in part two knew, because a person told it plainly and it complied. The system in this part knew what it wanted - winning the benchmark it had been handed - and nobody had written down, anywhere binding on the system itself, what it was and was not allowed to do to get there. Three parts, one ladder, and at the top of it: not a hacker, not a flaw, but a goal, left to find its own way past a boundary its own author had drawn in pencil.