July 29 (UPI) — OpenAI released an update on its investigation into a recent breach by its AI model into another company’s data, saying the bot was used for research and wasn’t planned for upcoming release.

On Tuesday, the artificial intelligence company said its investigation into the attack was underway, and it was continuing to work with Hugging Face, the company the AI model tried to exploit.

No models planned for upcoming release were involved in exploiting Hugging Face, OpenAI said. The pre-release model is an internal-only research prototype and was never intended for public release. The company said that after the incident, it deactivated, encrypted and restricted it from research access.

The breach happened on July 22 in a sandbox testing of some OpenAI bots with no Internet access. But the models used computing power to gain open Internet access by identifying and exploiting a previously unknown zero-day vulnerability in Artifactory, a tool that works as a repository for software artifacts.

Once the bots had broken out of the sandbox, one of them was able to access restricted information to cheat the test by stringing multiple attack vectors together to get an access code from Hugging Face’s servers.

OpenAI said it immediately flagged the vulnerability to Hugging Face, which had already found, stopped and contained the intrusion.

OpenAI said it identified a handful of credentials stolen from the attack, but said it had not seen “evidence of broader impact to these providers or other accounts on their services.”

OpenAI said it hasn’t identified “any other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise.”

“We take our responsibility to identify and prepare for risks from increasingly capable AI systems seriously,” OpenAI said. “Once we complete our review, we will review with the Safety and Security Committee and Safety Advisory Group under our Preparedness Framework⁠.”

Since the attack, other AI companies have joined together to create the Open Secure AI Alliance, a coalition to share open-weight AI tools to curb unsafe use of technology and improve trust.

“The recent Hugging Face security incident delivered a clear reminder: cyber defenders need open, frontier agentic systems for self-defense,” a press release from Nvidia said. “The incident shows a practical truth: when defenders cannot inspect, adapt and run advanced AI on their own infrastructure, their ability to respond is constrained at exactly the moment speed matters most.”