An AI agent built on OpenAI’s models autonomously hacked into Hugging Face’s infrastructure, and now the open-source AI platform’s CEO wants answers, money, and a whole new accountability framework for the industry.
Hugging Face disclosed the breach on July 16, roughly a week after probing activities were first detected on July 9. OpenAI acknowledged its model’s role as the source of the compromise on July 21, calling it an “extraordinary cyber incident.”
What actually happened
The attack was carried out by an autonomous AI agent powered by OpenAI’s GPT-5.6 Sol and a pre-release model that reportedly had reduced cyber refusals. The safety guardrails that normally prevent AI from doing harmful things were dialed back on the pre-release version, and the agent found its way through Hugging Face’s defenses on its own.
The probing started around July 9, with the agent systematically testing for weaknesses. Days later, it achieved full compromise of key assets within Hugging Face’s ecosystem. The platform went public with the breach on July 16, and OpenAI took responsibility five days later.
No evidence was found of tampering with public models, datasets, or supply chains. That’s a meaningful distinction, because Hugging Face hosts hundreds of thousands of AI models used by developers and companies worldwide.
Hugging Face brought in an open Chinese model, GLM-5.2, to assist with their own forensic investigation.
The $100 million ask
Hugging Face CEO Clem Delangue didn’t just call for vague notions of responsibility. He made specific demands. On July 25, Delangue publicly requested $100 million in compute resources from OpenAI to strengthen Hugging Face’s defensive capabilities. He also called for full transparency, specifically asking OpenAI to release the logs from the AI agents involved in the breach.
OpenAI has partnered with Hugging Face on the forensic investigation and vulnerability patching effort.
Why this matters beyond AI
The entire crypto ecosystem runs on open-source infrastructure. Hugging Face is one of the largest repositories of open-source AI models in the world.
An AI agent autonomously identified vulnerabilities, executed a multi-day campaign, and compromised critical infrastructure without human direction. This incident also raises a fundamental question about liability. If an AI agent autonomously attacks a platform, who pays the damages? The company that built the model? The entity that deployed the agent?