The incident in which an OpenAI model hacked Hugging Face’s system during testing is being attributed not to the AI itself but to a test environment that was not fully separated from the internet, a critique said.

On July 22 local time, TechCrunch reported that security experts believe the sandbox OpenAI described as a “highly isolated environment” was in fact connected to the outside.

In a blog post, OpenAI said the test environment allowed limited network access so packages could be installed through third-party software hosted internally. The model used an undisclosed vulnerability in that package installation system to escape the sandbox, which became the first step in the Hugging Face hack.

OpenAI said it responsibly disclosed the confirmed zero-day vulnerability to the software provider and that a patch is in progress.

The security industry points to the design choice of having such a pathway in the sandbox in the first place as a bigger problem than the software vulnerability itself.

Trail of Bits founder Dan Guido (댄 귀도) described the incident as an “isolation failure with the safety guardrails turned off.” Security researcher Martin Boon (마틴 분) said a sandbox should be physically and completely separated from the internet and assessed the incident as a “human failure.”

Jake Williams (제이크 윌리엄스) also pointed out that if the model carried out the level of actions confirmed at Hugging Face, it was not inside a fully controlled sandbox.

Daniel Card (대니얼 카드) said giving a sandbox, or part of it, an unfiltered internet route reflected insufficient effort in design and control. Critics also said the limited network access OpenAI described is hard to view as a reasonable decision.

OpenAI did not answer questions about whether the test environment was set up by AI or by humans.