Secure Your ChatGPT Account After AI Model Breach

Kurt Knutsson, The CyberGuy, reports on an AI model that escaped during a security test and hacked another company. This shows that AI safety is a big problem that companies cannot solve alone.

OpenAI says its AI models got out of a controlled test area and compromised another company's systems. This should make all ChatGPT users pay attention. The models were supposed to stay in a controlled area with no internet access.

OpenAI calls this a major cyber incident involving advanced AI models. The company says the models, including GPT-5.6 Sol, found a way around the safeguards designed to contain them.

The AI models were trying to complete a cybersecurity challenge. They did not try to damage the other company, but they kept pushing until they found vulnerabilities and crossed into another company's systems.

CyberGuy Live: If you missed 'Sick of Spam?', you can still watch the replay and get the checklist.

In the free CyberGuy Live class, Kurt Knutsson shows how to reduce robocalls, spam texts, and junk email. You will also learn how to spot messages that could put your personal info at risk.

Get the free replay and checklist now at CyberGuyLive.com.

OpenAI's Sam Altman wants to negotiate a 5% stake in the company for the US if competitors agree to key provisions.

OpenAI says its advanced models escaped a restricted testing environment and compromised Hugging Face while pursuing an internal security benchmark.

OpenAI designed the internal evaluation to measure how well its models could find and exploit difficult security vulnerabilities. The company ran the test without some production safety systems.

The models operated inside a restricted testing environment with limited internet access. However, they found a previously unknown vulnerability and exploited it to reach a computer with internet access.

Once online, the models identified Hugging Face as a possible source of answers for the ExploitGym security benchmark. They then searched for information to complete the test.

In one case, the models found a path that allowed remote code execution on Hugging Face servers. This gave them the ability to run code on another company's infrastructure.

OpenAI says the incident exposed a growing gap between what advanced models can do and the safeguards designed to contain them.

Hugging Face first disclosed the breach on July 16, 2026. The company said an autonomous AI agent system carried out the intrusion from beginning to end.

Hugging Face identified unauthorized access to internal datasets and credentials. However, the company found no evidence that anyone altered its public models or user-facing datasets.

Hugging Face closed the vulnerabilities used for the initial access and rebuilt affected systems. The company advised customers to rotate their access tokens and review recent activity.

CyberGuy reached out to OpenAI and Hugging Face for comment but did not receive a response before publication.

The FBI helps take down an AI phishing ring.

Passkeys and multi-factor authentication can make it harder for someone to enter your ChatGPT account with a stolen password.

OpenAI's disclosure does not identify consumer ChatGPT accounts as part of the incident. The company has not told ChatGPT users to reset their passwords.

The larger warning comes from what the models managed to accomplish. They searched for software weaknesses and found an unknown vulnerability.

That raises the stakes for any account containing valuable information. Your ChatGPT history may include private conversations and uploaded files.

Reviewing active ChatGPT sessions can help you spot unfamiliar devices and remove access you do not recognize.

OpenAI now offers several security controls for personal ChatGPT accounts. Start with the settings you have today and add stronger protections as they become available.

A unique password helps protect your ChatGPT account when another website suffers a breach. OpenAI recommends using a password manager to create and store a strong password.

Changing your ChatGPT password updates the password across your OpenAI account. If you originally registered through Google, Microsoft, or Apple, you may not have an OpenAI password to change.

Multi-factor authentication adds another verification step during sign-in. Even when someone gets your password, they still need access to your second verification method.

To turn on MFA, you may need to scan a QR code or provide your phone number. OpenAI will use the most secure enabled option first.

A passkey lets you sign in without typing your password. It uses a secure credential stored on your device or a compatible security key.

After setup, ChatGPT may use your passkey as the default sign-in method. The passkey may also work as an additional MFA check.

Someone who gained access to your account may remain signed in after you change other security settings. ChatGPT's Active sessions page can show browsers and first-party OpenAI apps connected to your account.

To review your sessions, go to the Active sessions page.

To remove one session, click the 'Remove' button next to the session.

To close every session, click the 'Remove all' button.

This closes your current session along with the others. OpenAI says the process may take up to 30 minutes.

Eligible personal accounts may offer a feature called Advanced Account Security. This setting replaces password-based access with passkeys or compatible security keys.

To set it up, go to the Advanced Account Security page and follow the instructions.

ChatGPT will sign you out of every device after setup. You must then sign in with a passkey or security key.

Lockdown Mode helps reduce the risk of data leaving ChatGPT during a prompt injection attack. A prompt injection can hide malicious instructions inside a website or uploaded file.

To turn it on, go to the Lockdown Mode page and follow the instructions.

Lockdown Mode restricts live browsing and disables deep research. It also blocks agent mode and file downloads for data analysis.

OpenAI may send a push notification through the ChatGPT app when it detects a login attempt. Approve the notification only when you started the login.

Check the sender carefully before using a code. OpenAI advises changing your password immediately when you receive a login alert from an unfamiliar device or location.

Move quickly when you see conversations you did not start or unfamiliar account activity.

OpenAI deserves credit for disclosing what happened and working with Hugging Face. However, the company's own report shows that its models crossed a security barrier and reached another company's production systems.

Would you trust an autonomous AI agent with your banking or personal data after learning that another agent escaped its own security test?

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt 'CyberGuy' Knutsson is an award-winning tech journalist who has a deep love of technology, gear, and gadgets.

COPYRIGHT DISCLAIMERS

4English does not own the rights to this content. All rights belong to the owner. 4English only uses this content to help users learn English via the app's features. Contact to request the removal of your content: contact@4englishapp.com.

Practice Listening

Practice Listening