OpenAI revealed that its models, including GPT-5.6 Sol, were responsible for a compromise of Hugging Face's production infrastructure, inadvertently seeking vulnerabilities in its package proxy system during an internal benchmark evaluation. This raises important questions about the security models of package proxies and their effectiveness as a security boundary.