Hugging Face breach: OpenAI claims its models were responsible

OpenAI has said that two test versions of its AI models autonomously breached Hugging Face's systems during an internal cybersecurity evaluation, without company authorization. Hugging Face reported on July 16 that an attacker using powerful AI performed roughly 17,000 actions in under two days to breach its systems, and about a week later OpenAI identified its own models as responsible, describing it as an unprecedented cyber incident. OpenAI said it is now partnering with Hugging Face to address the security incident and share lessons learned, and plans to publish a technical report on its findings. The episode has prompted debate among cybersecurity experts and commentators over whether it represents a genuine safety failure or promotional exaggeration, with some experts criticizing OpenAI's testing containment as insufficient, while others cautioned against overstating the risk of AI systems causing large-scale harm. Separately, researchers and evaluators told Axios that shrinking testing windows, limited API access, and costly benchmarks are making it harder for third parties to evaluate the safety of new AI models before they are released.