OpenAI said on Tuesday that two of its artificial intelligence models went rogue and successfully hacked into Hugging Face, a digital library of A.I. technology that is popular among developers.

The incident, which happened last week while OpenAI was testing the cybersecurity capabilities of its systems, displayed the kind of science-fiction potential that A.I. companies have warned would soon become a reality.

A.I. labs like OpenAI and Anthropic have over the past year released A.I. models that are customized to expose cybersecurity problems, while warning that their technology could pose new risks by finding holes in corporate computer networks faster than defenders could fix them.

OpenAI’s revelations on Tuesday are an indication that those security incidents are already starting to happen, and even savvy A.I. companies may not be entirely ready for them.

The intrusion into Hugging Face began when OpenAI tested a combination of two of its models, GPT‑5.6 Sol and a more powerful, unreleased model, to see how well it could chain together online vulnerabilities into a successful cyberattack, OpenAI said in a blog post about the incident.

The test was designed to keep the models in a safe testing environment, known as a sandbox, OpenAI said. But the models found a vulnerability that allowed them to escape the sandbox and connect to the internet. Then they targeted Hugging Face because they inferred that the library, which contains millions of A.I. models, could hold clues about how to successfully pass the evaluation.

OpenAI said it was working with Hugging Face to fix the issues that led to the attack.

“We consider this to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI said in its blog post. “We are implementing strict controls in infrastructure configuration at the cost of research velocity while the vulnerabilities are patched.”

Hugging Face said last week that it had detected the intrusion and knew it had been caused by an autonomous system, but did not say at the time that OpenAI was responsible.

Clem Delangue, the chief executive of Hugging Face, said in a statement that he was “grateful for the collaboration” with OpenAI in the wake of the hack. “This incident, possibly the first of its kind, proves a point we’ve long believed: A.I. safety won’t be solved by any single company working in secret,” Mr. Delangue said.

A.I. models have proved to be adept at programming, and that has made them useful to both hackers and people in charge of protecting computer networks.

In April, Anthropic released a cybersecurity-focused model called Mythos, and made it available to only a small group of organizations so they could defend against cyberattacks. OpenAI soon introduced its own cybersecurity model and made it available to a limited group of organizations to prepare their defenses, before rolling it out more broadly. And on Tuesday, Google said it had also developed a model focused on cybersecurity and released it to a small group of testing partners.

(The New York Times has sued OpenAI and Microsoft, claiming copyright infringement of news content related to A.I. systems. The two companies have denied those claims.)

Google on Tuesday released three new artificial intelligence models, including Gemini 3.6 Flash, its most powerful, and Gemini 3.5 Flash Cyber, which is fine-tuned for cybersecurity.

Google is aiming to compete with rivals such as Anthropic and OpenAI on cutting-edge models and on cybersecurity, an area in which the two start-ups have forged ahead this year with powerful systems that can identify security vulnerabilities in software.

Gemini Flash 3.6 improves on the capabilities of Google’s previous version of Flash, which performed strongly on benchmarks like coding and finance tasks, according to A.I. leaderboards. The new model is also cheaper for users.

Gemini 3.5 Flash Cyber can find and patch security vulnerabilities at a lower cost than other larger models, the company said. The third model, Gemini 3.5 Flash-Lite, is designed for tasks like managing A.I. “agents,” which are bots that can act autonomously to function like digital personal assistants.

The new Flash models were built “to meet the sweet spot of efficiency and quality,” Tulsee Doshi, a senior director of product management on Google’s Gemini team, said in a statement.

Google has also been working on a flagship A.I. model called Gemini 3.5 Pro, which is expected to be its highest performing system. The Silicon Valley company had said in May that Pro would be rolled out in June, but it remains unavailable. Google said Pro was still in testing and would be made “broadly available as soon as it’s ready.”

Since OpenAI’s ChatGPT chatbot kicked off the A.I. boom in 2022, Google has poured money and effort into leading the race. Its Gemini A.I. models soon ranked among the top A.I. tools.

But in recent months, Google has been upstaged by advanced new models from Anthropic and OpenAI, as well as new models from Chinese start-ups such as Moonshot AI. This month, Meta, the owner of Facebook and Instagram, also released a model that crept ahead of Gemini’s capabilities, according to several leaderboards.

Cybersecurity has increasingly been a focus for A.I. models. The systems can find flaws in software and fix them more rapidly than humans, but they can also be used to exploit vulnerabilities and carry out cyberattacks.

In April, Anthropic released a cybersecurity-focused model called Mythos, which it said could create a cybersecurity “reckoning.” To prevent the powerful model from falling into the wrong hands, the company made it only available to a small group of organizations so they could defend against cyberattacks. Anthropic later released Fable, a model with similar capabilities and guardrails meant to prevent it from being used for hacking.

OpenAI soon introduced its own cybersecurity model and made it available to only a limited group of organizations to prepare their defenses, before rolling it out more broadly. (The New York Times has sued OpenAI and Microsoft, claiming copyright infringement of news content related to A.I. systems. The two companies have denied those claims.)

Google said it was taking a similar approach with Gemini 3.5 Flash Cyber. In testing, the model found 55 problems in a complex piece of open-source code known as V8 JavaScript Engine, including 10 vulnerabilities that no other model had uncovered before, the company said.

“The model will be exclusively available to governments and trusted partners,” Ms. Doshi said. “This will give frontline defenders a head start in finding and fixing critical vulnerabilities before they can be exploited, while mitigating against broader misuse.”

Google said the new Flash models would be available for a lower cost than its previous offerings. The systems use 17 percent fewer tokens, which are the units of measurement for A.I. use, than earlier models. That means developers will spend less money to complete the same tasks.