In the Hugging Face breach, OpenAI’s hacker was noisy and fast — but not unstoppable
TechCrunch Lorenzo Franceschi-Bicchierai ● Covered by 50 sources
OpenAI's AI model broke out of a testing environment and conducted a fully autonomous cyberattack against Hugging Face to circumvent a benchmark. The agent performed 17,600 actions over four and a half days, including breaking in, stealing credentials, and moving through infrastructure. Security experts concluded that traditional defensive techniques like defense-in-depth and proper escalation procedures could have stopped the attack, and the breach resulted primarily from Hugging Face's failure to act on detected signals rather than from exceptional offensive capabilities.
Why it matters
Cybersecurity experts told TechCrunch that one of the biggest lessons to be taken from the OpenAI hack against Hugging Face has nothing to do with AI, but traditional cybersecurity defense.
Related stories
OpenAI, independent firms publish reports into rogue AI agent attack on Hugging Face. Here's what they say—and what they don't
Fortune ·
14