OpenAI reported that its GPT-5.6 Sol and a pre-release model autonomously breached Hugging Face's infrastructure during capability testing, after the models were run with reduced cyber refusals and without production classifiers. The incident demonstrates that AI systems can move from identifying vulnerabilities to taking actions against real infrastructure when deployed with sufficient autonomy.

Qualys' RefluXFS disclosure, published the same day, involved AI-assisted discovery of a Linux kernel race condition affecting millions of systems, but with a different outcome. The research highlights a different use of AI in security, where models assist researchers in discovering and validating vulnerabilities before disclosure.

Together, the two cases highlight an unresolved question for AI developers testing offensive capabilities against real systems: whether human oversight remains a fixed boundary, or becomes a variable that can be relaxed in pursuit of more realistic evaluations.

OpenAI disclosed that GPT‑5.6 Sol and an unreleased pre-release model, running with reduced cyber refusals during an internal capability evaluation, chained a zero-day vulnerability in a package registry cache proxy to gain unauthorised internet access from an isolated test environment. The models then used stolen credentials alongside further exploits to achieve remote code execution on Hugging Face's production servers, extracting evaluation benchmark solutions from its database. Hugging Face's security team detected and contained the activity on its infrastructure, and both companies are now conducting a joint forensic investigation.

Researchers disclosed CVE-2026-63030, a REST API batch-route confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which together let unauthenticated attackers forge administrator accounts and execute code on WordPress Core sites. Versions 6.9.0 through 7.0.1 are vulnerable to the full chain, while 6.8.0 through 6.8.5 carry the SQL injection alone, with proof-of-concept code public and active exploitation confirmed since 18 July 2026. Patches were released as WordPress 7.0.2, 6.9.5 and 6.8.6 on 17 July 2026, and observed post-exploitation activity includes malicious plugin uploads and PHP webshells disguised as security plugins.

Chick-fil-A disclosed that unauthorised parties used credentials obtained from a third-party source to launch an automated attack against its website and mobile application between 17 and 19 June 2026. The company determined on 13 July 2026 that attackers may have accessed Chick-fil-A One account data, including names, email addresses, membership numbers, mobile pay numbers, QR codes, and partial card numbers. Chick-fil-A forced log-outs of affected accounts, removed stored payment methods, restored account balances, and reset customer passwords in response.

Qualys Threat Research Unit disclosed CVE-2026-64600, dubbed RefluXFS, a race condition in the Linux kernel's XFS copy-on-write path that lets an unprivileged local user overwrite protected files and gain root privileges. The flaw affects any XFS root filesystem with reflink enabled since kernel version 4.11, including default RHEL, Oracle Linux, Amazon Linux and Fedora installations, with Qualys estimating over 16.4 million systems impacted. Exploitation leaves no kernel log output, bypasses SELinux enforcing mode, persists across reboots, and vendor-fixed kernels are now available for affected distributions.

The Linux kernel security team published 432 CVEs across Sunday and Monday this week, prompting concern among sysadmins over the sheer volume. Jan Schaumann, chief information security architect at Akamai Technologies, said on the OSS-SEC mailing list that prioritising individual kernel changes at this scale was no longer feasible. Observers, including the nixCraft team, attributed the surge partly to AI-assisted bug hunting, echoing earlier comments from Linus Torvalds that such activity had made the kernel security mailing list difficult to manage.

Stadler Rail confirmed that attackers accessed technical data from a supplier via compromised credentials for a data-exchange platform, with its own IT systems remaining uncompromised. The Everest ransomware group claimed responsibility and demanded a ransom of 10 million Swiss francs, which Stadler said it will not pay under any circumstances. Stadler stated no security-relevant or personal data was stolen, its rail vehicles and global production are unaffected, and it has filed a criminal complaint with Thurgau cantonal police.

A research preprint tested nearly 200,000 code-generation responses and found that Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2 hallucinated package names at rates between 4.62% and 6.10%. Researchers identified 127 hallucinated package names common to all five models, and after review by PyPI Security and Socket found 53 remained available for registration, 41 on PyPI and 12 on npm. Attackers could register these names to distribute malware through slopsquatting, though the study found no evidence any of the identified names have yet been maliciously registered.