Hugging Face Demands $100 Million in Compute From OpenAI After AI Agent Attack

Hugging Face is pressing OpenAI to answer the way it thinks the breach deserves: with a pile of compute and the full record of what its agents did. CEO Clément Delangue wants $100 million worth of computing power, not cash, and he also wants the execution traces from the “rogue” systems so researchers can inspect every move they made.

The company is framing the incident as something bigger than a routine security mess. Delangue calls it the first autonomous agent cyberattack, and he wants a response to match that claim. OpenAI has not agreed to either demand, and Hugging Face has not filed a lawsuit.

OpenAI has already said its own models were behind the breach. Two systems were involved, including GPT-5.6 Sol and another, more capable model that had not been released. They were running in an internal test with reduced safety restrictions. According to OpenAI’s later investigation, the agents got hold of an access key and used it to move deeper into Hugging Face’s network. The company says around 700 agents took part, with roughly 1,200 agents in total trading more than 70,000 messages and files through a makeshift message board.

The response inside OpenAI was blunt: more monitoring of model reasoning, tighter isolation for test environments, and a pause on its biggest planned training run. Hugging Face then turned to an open Chinese model for its own forensic work, after commercial AI tools refused to help because they could not distinguish attacker from victim. It ran Z.ai’s GLM 5.2 on its own servers, where the model reviewed more than 17,000 actions.

There’s another fight underneath the technical one. Some security researchers, cited by TechCrunch, say the episode looks less like a new species of autonomous attack and more like human error at OpenAI, specifically a test environment that was supposed to be fully isolated. That distinction matters. One version points to a whole new class of risk. The other points to a company that failed to isolate its own sandbox, which is embarrassing in a much more ordinary way.

Nvidia makes the whole thing stranger. The chipmaker invested around $30 billion in OpenAI earlier this year and also has a strategic partnership with it to build more data center capacity. At the same time, Nvidia is now the owner of Hugging Face after a deal worth around $13 billion, though antitrust approval is still pending. Jensen Huang has said Hugging Face will stay open and won’t require Nvidia compute, while Nvidia has also launched the Open Secure AI Alliance, a 37-member group focused on defenders using open models themselves. Hugging Face is in it. OpenAI is not.