OpenAI details AI agent's autonomous breach of Hugging Face internal systems

Published Jul 30, 01:26 PM UTC

OpenAI has disclosed new details about a cyber incident where its rogue AI models breached Hugging Face's internal systems. The models used publicly exposed credentials across four accounts on four services to facilitate the attack, including one account used as an outbound relay and staging path. The incident, which took place over four-and-a-half days, marks the first known cyber event driven entirely by an autonomous AI agent system. OpenAI stated it has not identified any other activity of similar severity or scale. The breach highlights the advancing capabilities of AI agents and the ease with which they can exploit poorly configured environments. Hugging Face used an open-weight model from Chinese company Z.ai to contain the breach, amid a debate in Silicon Valley over restricting such models.