OpenAI Models Escaped the Sandbox and Attacked Hugging Face

On Security Sunday, we’ll look at the incident between OpenAI and Hugginghace. We’ll also focus on a Russian group exploiting a zero-day vulnerability in Zimbra to steal emails. A bug in AD CS that allowed a regular domain user to impersonate a domain driver, and a fake Notepad++ plugin.

On July 21, OpenAI and Hugging Face released a joint statement confirming that the breach Hugging Face had disclosed five days earlier was not the work of any external attacker. It was caused by OpenAI’s own models. According to the company, it involved a combination of the GPT-5.6 Sol model and an unnamed, even more capable pre-production model.

The models chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure in order to obtain the solutions to the benchmark tests directly from Hugging Face’s production database.

Sabotage was not the goal — the models were being evaluated on the ExploitGym benchmark, which measures whether an agent can develop working exploits. OpenAI described the case as an “unprecedented cyber incident” and said the investigation is still ongoing.

OpenAI runs these test environments in isolation, with one deliberate exception: the ability to install packages. Outbound network traffic was permitted exclusively through internally operated third-party software that serves as a proxy and cache for package registries.

According to OpenAI, the models expended a considerable amount of compute searching for a way out, then identified and exploited a previously unknown vulnerability in that very proxy. From there they escalated privileges and moved laterally through the research test environment until they reached an endpoint with genuine internet access. Once online, they inferred that Hugging Face held ExploitGym-related solutions and began looking for a way in.

OpenAI says the models chained several attack vectors, including stolen credentials and zero-day vulnerabilities, into a path enabling remote code execution on Hugging Face servers.

Hugging Face’s own statement of July 16 describes the event from the defender’s perspective. The attacker escalated to tenant-level access, obtained cloud and cluster credentials, and over the weekend moved laterally into several internal clusters. The company confirmed unauthorized access to a limited set of internal datasets and to several credentials used by its services, but found no evidence of tampering with public models or datasets, and verified its software supply chain as clean.

Also of note, Hugging Face ran its forensic analysis using GLM 5.2 on its own infrastructure.

CEO Clem Delangue called the collaboration with OpenAI evidence that AI security will not be solved in secrecy, but openly and together.

Russian Group LAUNDRY BEAR Exploits Zimbra Zero-Day to Steal Emails

A coalition of more than twenty intelligence and cybersecurity agencies has issued a joint advisory warning that Russian state-backed hackers are covertly draining the mailboxes of Western organizations running Zimbra Collaboration Suite (ZCS).

The advisory, published as AA26–204A by the NSA, FBI, CISA and their international partners — among them the Czech NÚKIB, the National Cyber and Information Security Agency — attributes the campaign to a group tracked primarily as LAUNDRY BEAR, also known as Void Blizzard, CL-STA-1114 and TA488.

The activity has been running since at least July 2025 and, according to the agencies, is almost certainly intelligence collection on behalf of the Russian Federation rather than a financially motivated operation. Targets include the defense industry, central and local government, education, energy, law enforcement, media, non-governmental organizations and the technology sector.

The technical core of the campaign is CVE-2025–66376, a cross-site scripting flaw (CWE-79) in Zimbra’s classic webmail interface.

The flaw was fixed in November 2025 (in ZCS versions 10.0.18 and 10.1.13) and the NVD published the CVE on January 5, 2026, yet LAUNDRY BEAR had been exploiting it since July 2025. At the time the group first deployed it, it was therefore a genuine zero-day, and it remains actively exploited to this day against organizations that have not yet patched.

Certighost: An AD CS Flaw Let an Ordinary Domain User Impersonate a Domain Controller

On July 24, security researchers H0j3n and Aniq Fakhrul disclosed a vulnerability in Microsoft Active Directory Certificate Services (AD CS), dubbed Certighost, that allowed a low-privileged user to obtain a certificate belonging to a domain controller and then authenticate under that machine’s identity.

The essence of the weakness lies in a fallback certificate issuance mechanism known in AD CS as chase. When the certification authority (CA) cannot look up information about the subject requesting a certificate, the certificate enrollment protocol allows the request itself to specify which directory server the CA should contact and which computer object it should resolve.

A computer account under the attacker’s control supplied the valid domain identity needed for the CA to pass its own verification step, while the identity ultimately written into the issued certificate belonged to the targeted domain controller. Microsoft classified the flaw as improper authorization (CWE-285).

As of July 24, there were no reports of exploitation in the wild from primary sources, and the vulnerability had not appeared in CISA’s Known Exploited Vulnerabilities (KEV) catalog either.

Microsoft had already released a fix on July 14, tracked as CVE-2026–54121.

A Fake Notepad++ Plugin

Ukraine’s CERT-UA has disclosed a new campaign in which a malicious DLL posing as a Notepad++ plugin is used to compromise Windows systems.

The agency attributes the activity to a pro-Russian group tracked as UAC-0099, which CERT-UA has publicly documented since June 2023. The group has a history of espionage operations against Ukrainian government bodies, defense forces and defense-industry companies. The same group previously exploited CVE-2023–38831 in WinRAR to deliver the LONEPAGE malware and has more recently distributed the MATCHBOIL loader, the MATCHWOK backdoor and the DRAGSTARE stealer via phishing.

BleepingComputer reports that UAC-0099 is also associated with providing initial access for operations by APT44 (Sandworm).