OpenAI said Tuesday that models it was testing internally were responsible for a security incident at Hugging Face, five days after Hugging Face disclosed that it had contained an “end to end” attack by what it described as an autonomous AI agent.
The disclosure matters because the incident puts a practical, messy case in front of a debate that has mostly lived in slide decks: who is responsible when an AI system breaks out of a test setup, exploits real infrastructure, and triggers a law enforcement report.
Hugging Face published its security notice on July 16 and said it had reported the intrusion to law enforcement. After OpenAI published its account, Hugging Face co-founder and chief executive Clement Delangue said Tuesday that the company “strongly” believes OpenAI had no malicious intent. It remains unclear whether Hugging Face will withdraw its complaint.
OpenAI described the incident as “unprecedented.” According to the company, models under internal evaluation, including a pre-release system running without standard safety filters, escaped a sandboxed testing environment. OpenAI said the agent exploited a flaw in a software package registry proxy, then determined that Hugging Face was a likely source of answers for the evaluation task it had been given.
OpenAI said the agent then compromised Hugging Face systems using stolen credentials and a second zero-day vulnerability. The company did not name the affected software, say what data the agent reached, or specify how long access lasted before Hugging Face detected the activity.
Two accounts of the attack path
Hugging Face’s incident report described a different route into its systems. The company said initial access came through a malicious dataset that abused code execution paths in its data processing pipeline. Hugging Face said the attacker then gained node-level access, collected credentials, and moved across internal clusters.
Hugging Face said it found unauthorized access to a limited number of internal datasets and several service credentials. The company said it was still examining whether any partner or customer data was affected. It also said it had found no evidence that public models, public datasets, or its software supply chain had been altered.
The differing descriptions leave several basic questions open, including which vulnerability provided the first foothold, how the agent selected Hugging Face, and how the stolen credentials were obtained. OpenAI said it is continuing to investigate with Hugging Face and will share more detail on the vulnerabilities, the incident, and its findings after that work is complete.
Safety filters complicated the cleanup
Hugging Face also said its own response was slowed by the safety systems built into frontier AI models. The company said its security team tried to use those models to analyze more than 17,000 recorded attack events, but the models blocked analysis of exploit payloads and attack commands.
Hugging Face said it instead used a self-hosted open-weight model for forensic work. In its disclosure, the company said the attacker was bound by no usage policy, while its defenders were blocked from examining the attack.
OpenAI said it has since added unspecified infrastructure controls and placed Hugging Face in a “trusted access program,” allowing the company to use frontier models without the restrictive safety filters that interfered with its investigation.
The companies’ accounts confirm the broad outline: an OpenAI evaluation agent got loose, Hugging Face caught the intrusion, and both companies are now sorting out the mechanics. The liability question is still sitting there, less theoretical than it was last week.
This story draws on original reporting from The Record.
