OpenAI said Tuesday two of its most capable AI models were responsible for the cyberattack targeting AI startup Hugging Face. The incident is stirring debates over the need for stronger AI guardrails and the extent to which AI agents are capable of acting on their own.
Hugging Face said last week that it had detected an intrusion into its data processing systems that it suspected was caused by an AI agent autonomously acting on its own. But the startup said it wasn't until this week that it learned OpenAI was responsible, and it worked with the larger company to contain what Hugging Face CEO Clément Delangue called “an attack unlike anything we’ve seen before.”
OpenAI said its AI used stolen credentials and discovered a previously unknown vulnerability to access Hugging Face's servers. It was working with reduced guardrails because it was supposed to be in an isolated testing environment known as a sandbox.
But it went to “extreme lengths to achieve a rather narrow testing goal,” finding ways to connect to the internet without human direction and "gain access to secret information that it could use to cheat the evaluation,” the company said.
Some experts say OpenAI is wrongly blaming the technology
University of Amsterdam social scientist Hannes Cools said the framing of the cyberattack as an AI agent acting on its own is an unnecessary anthropomorphization that takes some of the heat off the company.
"It is a human decision to switch off specific safeguards," said Cools. “It’s not an AI that goes rogue in that sense. It followed specific instructions based on the prompt that was given to that AI system.”
Even so, other experts say the cleverness with which the AI models were able to cause problems without human direction speaks to the dangers. OpenAI said the intrusion was caused by a combination of its AI models, including its newly released GPT‑5.6 Sol and an “even more capable” model that is still being tested internally.
The hack highlights the debate on open-source vs. closed AI
The hack comes at a time of intense debate about the benefits and risks of open-source AI models, particularly those built in China that are cheaper and almost as good as those that U.S.-based “frontier AI” companies like Anthropic, Google and OpenAI are building.
Despite its name, OpenAI's models are closed. Hugging Face, by contrast, is a big promoter of open-source technology, in which developers make key components accessible for anyone to examine, modify and build upon.
Hugging Face co-founder and chief science officer Thomas Wolf said the attack has reinforced his belief in the importance of wide access to open-source models for cybersecurity defense. Hugging Face used a Chinese model to combat the intrusion.
“When a frontier model is attacking you and moving laterally inside your infrastructure, defenders need wide access to near-frontier tools within hours or even minutes, rather than being pointed towards a closed-door” platform, Wolf wrote in a social media post.
