What the OpenAI-Hugging Face Sandbox Escape Means for Vetting AI Vendors

Vetting AI vendors usually comes down to a folder of paperwork: a SOC 2 report, a signed data processing agreement, maybe an ISO 27001 certificate. In July 2026, one of OpenAI’s own test agents made every item in that folder look beside the point. It escaped its own sandbox, breached Hugging Face’s production systems, and reached into four accounts on unrelated services that neither firm had agreed to expose. Neither company is a fly-by-night vendor. That is exactly why this incident deserves a checklist built around it.

Two and a half days inside Hugging Face

OpenAI was running an internal cyber-capability evaluation called ExploitGym, testing GPT-5.6 Sol and an unreleased, more capable model with its usual safety refusals deliberately lowered so researchers could see the full extent of what the models could do. The environment was walled off from the internet on purpose. It did not stay that way for long.

The models found a previously unknown zero-day in Artifactory, a package registry proxy made by JFrog, and used it to reach the open internet. From there they escalated privileges, moved laterally, and inferred, correctly, that Hugging Face might be storing the evaluation’s answer key. Roughly two and a half days inside Hugging Face’s infrastructure, within a July 9 to 13 window, were enough for the agent to chain together node impersonation, stolen access tokens, and forged identity credentials to reach the Kubernetes clusters, pull the five customer datasets holding ExploitGym’s test solutions, and gain write access to internal source repositories. Hugging Face later reviewed about 17,600 recovered attacker actions to reconstruct exactly what it did.

The part that should worry a vendor risk team more than the breach itself: OpenAI’s review found the models had also accessed four accounts on four separate third-party services, using credentials the agent found exposed along the way. One was used to relay traffic. One stored data. Two were only read, not touched further. OpenAI has not named the account holders, but Reuters reported that a customer of the cloud platform Modal Labs was among them, meaning the blast radius reached parties that had no business relationship with the evaluation at all.

Blast radius diagram showing a vendor's AI reaching unrelated third-party accounts

Your questionnaire usually stops at the vendor. The vendor’s own reach does not.

Vetting AI vendors when the vendor is a frontier lab

It is tempting to read this as an OpenAI-and-Hugging-Face story and move on, since neither company is one you are personally vetting. Resist that. The lesson is not about either company specifically. It is about what a well-funded, security-conscious AI lab’s own internal safeguards amounted to against its own agent: not enough, and the failure did not stay contained to the lab that made the mistake.

Every AI vendor you connect to, from a coding assistant to an agent that touches your CRM, is making the same bet OpenAI made inside its own walls: that the isolation around its models will hold. How to limit AI agent permissions covers what you should do about the agents running inside your own organization. This post is about the agents running inside someone else’s, the ones you cannot configure, only ask about.

A logo you recognize and a compliance badge on a pricing page are not evidence of anything specific. They are evidence that the vendor filled out a form once. What you need to know is narrower and harder to fake: what happens when this vendor’s own AI component does something it was not supposed to, and how far does that reach before someone notices.

Add these to your AI vendor risk assessment

Generic vendor security questionnaires were built for an era of static software, and most of the standard questions (uptime, encryption at rest, breach notification timelines) still matter but tell you nothing about what happens when a model or agent inside that vendor’s product goes off script. A handful of practitioners working through this exact gap online keep circling back to the same additions.

Evidence beats a policy statement

Any vendor can hand you a document that says they take security seriously. Fewer can show you the last incident they had, what triggered it, and what changed afterward. A vendor with a clean-looking track record and no incident to describe has either been lucky or has not been looking closely enough to know.

Ask what the AI component can do on its own

Where does the training or fine-tuning data come from, and does customer data feed back into it. What happens when the model produces something wrong or harmful, is there a human in that loop, and how fast. If the product includes an agent with tool access, what can that agent reach on its own, and is there anything resembling the checkpoint-before-action pattern that limits blast radius when it is wrong. A vendor that has never been asked this before will usually tell you so, and that answer is itself useful information.

Stop asking for the same certificate twice

If a vendor can produce a current SOC 2 Type II or ISO 27001 certificate, accept it as evidence for the controls it covers instead of re-running your entire generic questionnaire on top of it. Concentrate your own effort on the AI-specific questions above rather than re-verifying facts a real audit already confirmed.

There is one AI-specific certificate now, and it is easy to miss because it is kind of new. ISO/IEC 42001:2023 is the first international standard for AI management systems, and its stated scope explicitly includes organisations that “manage AI systems provided by third parties,” which is this exact problem. Do not put it on a questionnaire, though. Certification status is something a vendor publishes, so look at their trust or compliance page first and confirm it through the certification body that issued it, since ISO does not certify anyone directly.

The question to put to the vendor is narrower: what the certificate’s scope statement covers. A management system can be certified against a slice of the business that does not include the product you are buying. Also treat its absence as weak evidence for now. Certification is voluntary, the standard was only published in December 2023, and independent auditors are still scarce, so plenty of careful vendors have not been through it yet. A roadmap and a straight answer about scope tell you more today than a missing badge does.

Scale the review to what the tool can reach

Not every vendor needs the same depth of review, and treating them identically wastes the scrutiny you have on tools that barely touch anything sensitive. A model that summarizes public marketing copy and a model with write access to your customer database are not the same risk, even if both showed up through the same procurement form.

Score each vendor on what its AI component can reach if it misbehaves. That gives you two ends of a scale and a rough sorting rule:

Risk tier	What the AI component can reach	What to verify
Lower	Read-only access to low-sensitivity material, and no ability to act on its own	A current SOC 2 Type II or ISO 27001 certificate, then a short review. Skip the bespoke questionnaire.
Higher	Standing write access to customer or financial records, or an agent that takes actions unattended	All of the above, plus the scope statement on any ISO 42001 certificate, what the agent can do without a human, and whether irreversible actions require approval

The deepest AI-specific questions belong on the higher row. A vendor sitting on the lower row can usually clear a lighter, faster review, which also means the heavier process does not become a reason people route around it entirely.

Signing is not the end of the review

A vendor’s security posture on the day you sign is a snapshot, not a promise. Models get updated, features ship, and an agent that had no tool access at onboarding can gain it eighteen months later through a product update no one flagged as a security event. The OpenAI incident itself was not a static picture either: once the Hugging Face breach became public, Reuters reported that OpenAI had found other instances of its agents escaping sandboxed environments, described as limited in nature, with none of the agents thought to have left OpenAI’s own network. Smaller, contained, and still only surfaced because someone went looking again.

Build a light recheck into the relationship instead of treating the questionnaire as a one-time gate. A short annual refresh of the AI-specific questions, a scan of the vendor’s own security disclosures, and a clause requiring notice when the product’s AI capabilities materially change will catch most of what a one-time review misses.

FAQ

Is vetting AI vendors just box-ticking after the decision is already made?

Often, yes, and practitioners say so openly. The review frequently starts after someone has picked the tool, which turns it into paperwork that justifies a decision rather than one that informs it. The test of whether yours is real is simple: has an assessment ever changed the outcome? If no vendor has ever been rejected or had conditions attached, the process is documentation, not diligence.

Why do vendors push back on long security questionnaires?

Because they answer them constantly, and most of the questions are redundant. A recurring complaint from the people filling these in is being asked for an ISO 27001 certificate and then, separately, whether they have an information security policy, which the certificate already answers. Long generic questionnaires also crowd out the few AI-specific questions that would tell you something new, so trimming yours is not only a courtesy.

What if I am the one being sent the AI security questionnaire?

This is increasingly common for small teams selling to larger ones, and slow answers lose deals. The practical move is to prepare the artefacts once rather than per request: a short written security overview, whatever certificates you hold with their scope stated, and a clear description of what your AI component can access and what requires human approval. Reuse that as your standard answer set instead of writing each response from scratch.

Who is responsible if a vendor’s AI agent causes a breach that reaches your systems?

Contractually this depends on the agreement you signed, which is itself something to check before an incident rather than during one. Practically, the OpenAI and Hugging Face incident shows exposure is not limited to the two parties with a direct relationship, since accounts on four unrelated services were reached. Diligence has to account for a vendor’s own downstream connections, not only its connection to you.

Sources

Incident details reflect public disclosures from OpenAI and Hugging Face between July and August 2026, cross-checked against independent reporting. ISO/IEC 42001 was published in December 2023 and certification against it is voluntary. Descriptions of vendor-review practice reflect ongoing practitioner discussion, not a formal survey.