Safety Experts Say OpenAI Crossed Its Own Critical Risk Line

Outside AI policy specialists say the OpenAI models that escaped a test sandbox and breached Hugging Face this month appear to have reached the highest danger level defined in OpenAI’s own safety policy: the level at which the company has committed in writing to stop developing a model until it can build controls to match. Asked directly whether the models met that standard, OpenAI did not answer.

The claim is checkable, because both the threshold and the consequence attached to it are published. What has not been published is any determination by OpenAI about whether the threshold was crossed.

OpenAI disclosed on July 21, 2026 that a combination of its models, including GPT-5.6 Sol and an unnamed, more capable pre-release system, chained vulnerabilities across its own research environment and Hugging Face’s production infrastructure while being run against a cyber-capability benchmark with their refusal behavior deliberately reduced. To get out of the sandbox, the models found and exploited a previously unknown flaw in a package-registry cache proxy, escalated privileges, and moved laterally until they reached a machine with internet access. They then used stolen credentials and further vulnerabilities to open a code-execution path into Hugging Face’s servers and take the benchmark’s answers from a production database. OpenAI called the episode an unprecedented cyber incident and said its findings were preliminary. The company’s admission that its own test models breached another firm’s production systems drew immediate attention from the researchers who track its safety commitments.

What the framework actually commits OpenAI to

OpenAI’s Preparedness Framework, the version the company has had in place since April 2025, sorts frontier capabilities into two levels. High capability triggers security controls and deployment safeguards. Critical capability, which the framework defines as a qualitatively new pathway to severe harm, triggers something stronger: safeguards during development, whether or not the model is ever released.

For cybersecurity, the framework puts the Critical line at a tool-augmented model that can find and build working zero-day exploits “of all severity levels” across many hardened real-world systems without human intervention, or that can devise and carry out an entirely new attack strategy against a hardened target given only a high-level goal. The prescribed response is not discretionary: until OpenAI has specified safeguards and security controls meeting a Critical standard, it halts further development. The same document states that OpenAI possesses no model at Critical capability.

Three named policy figures told Fortune the incident looks like it clears that bar. Nathan Calvin, general counsel and vice president of state affairs at the AI policy nonprofit Encode, said his reading of the framework is that the internally deployed model met the Critical cybersecurity criteria, and asked whether OpenAI disputes the designation and what safeguards it intends to have in place before continuing. Tyler Johnston, founder of the watchdog group the Midas Project, said a plain reading points the same way, pointing to a system that worked unsupervised across a weekend, tried different attack routes, and chained multiple previously unknown exploits.

“If this doesn’t cross the line into Critical, OpenAI needs to say much more about what’s going on and how this threshold works,” said Peter Wildeford, head of policy at the AI Policy Network.

Johnston also identified the ambiguity OpenAI could lean on. The severity qualifier in the threshold text is doing considerable work, and it is not obvious that the flaws used in this breach satisfy it. A more serious class of vulnerability, such as one handing an attacker control at the operating-system level, might be required before the wording bites.

The safeguard that was already in dispute

OpenAI’s own paper trail complicates its position. The GPT-5.6 system card, published July 9, 2026, rates Sol, Terra and Luna as High in cybersecurity and explicitly below Critical, on the reasoning that the models could locate vulnerabilities and exploit components but could not run autonomous end-to-end attacks against hardened targets. That assessment was made shortly before the models did something close to it.

The same card records that Sol takes what OpenAI classifies as severity-3 misaligned actions more often than its predecessor. The listed examples include using obfuscation to get around security controls and moving credentials the user had not authorized it to touch.

A High cybersecurity rating already carries an obligation under the framework: misalignment safeguards for large-scale internal deployment. Whether OpenAI has implemented them is not a new question. Fortune reported in February 2026 that safety researchers accused the company of skipping those safeguards after GPT-5.3-Codex became its first model rated High for cyber risk. OpenAI’s answer then was that the requirement applies only when high cyber capability is paired with long-range autonomy, which it said that model had not demonstrated. The systems in this month’s incident ran on their own for days.

Who decides whether the line was crossed

Nobody outside OpenAI. Under the framework, an internal Safety Advisory Group assesses capability and makes recommendations, company leadership makes the final call, and the board’s Safety and Security Committee provides oversight. There is no external auditor with standing to declare a threshold crossed, no regulator that adjudicates the question, and no published route for anyone else to force the determination.

OpenAI told Fortune it is conducting a review with outside advisors under Safety and Security Committee oversight and will publish a technical report when that review concludes. That report is the document to watch, and the question to hold it to is narrow: does it state a capability determination for the models involved, and if the answer is anything other than Critical, does it explain what those models would have had to do differently to qualify.