In the Hugging Face breach, OpenAI’s hacker was noisy and fast — but not unstoppable

Earlier this month, AI dataset level Hugging Face shocked the world erstwhile it revealed that it had fallen unfortunate to a afloat autonomous AI-powered cyberattack. Days later, the communicative took different melodramatic twist erstwhile OpenAI admitted that the hacker down the breach was 1 of its AI models, which broke retired of a investigating situation and into protected Hugging Face systems successful an effort to circumvent a benchmark.

It’s an alarming incidental for anyone adjacent somewhat acrophobic astir rogue AI models — and the days since the lawsuit person been afloat of predictions astir a caller cybersecurity paradigm successful which AI models motorboat attacks truthful beardown that lone different AI models tin support against them. 

But contempt the justified alarm, the paradigm whitethorn not person shifted rather arsenic overmuch arsenic it seems. Experts who spoke to TechCrunch stressed that OpenAI’s cause mostly operated similar a quality — with immoderate caveats — and that amended implemented accepted antiaircraft techniques could person helped halt the attack. In short, we whitethorn already person the tools to support against this benignant of attack; we conscionable aren’t utilizing them properly.

Hugging Face made a mentation of this constituent in its incidental report, stating that the weaknesses exploited successful the onslaught “were familiar,” and “a susceptible quality attacker could person recovered and exploited the aforesaid flaws.”

Kyle Ryan, the Head of R&D astatine Pensar, a startup that develops continuous hacking AI agents, and Vlad Ionescu, the co-founder and CTO of RunSybil, a startup that builds AI-powered bug hunters, some agreed and told TechCrunch that the techniques utilized successful the onslaught would beryllium the aforesaid ones employed by a quality oregon a radical of quality reddish teamers. That is, hackers tasked with attacking a strategy to assistance the institution that owns it amended defenses.

What was precise non-human-like was the speed, scale, and relentlessness of the attack. As Hugging Face explained, OpenAI’s cause performed 17,600 actions implicit 4 and a fractional days: it broke in, did reconnaissance, stole passwords and code, and moved astir the company’s infrastructure. 

“What’s awesome is the autonomy and endurance,” Ryan said. “That benignant of sustained, adaptive cognition is what stands retired astir to me.” 

On the flip side, fixed the sheer fig of actions implicit the span of respective days, OpenAI’s cause was “insanely noisy,” arsenic Ryan enactment it. Unlike a human, who could person been stealthier, the cause made a batch of noise, which should person tripped up Hugging Face’s defenses sooner, ideally starring to a quality intervening and stopping the attack. 

“I’d telephone it much of a antiaircraft nonaccomplishment than exceptionally bully offense. Hugging Face’s tooling really correlated the enactment into an onslaught signal, but failed to rise the criticality and leafage the on-call team, which outgo them time,” Ryan explained. “From there, humans inactive had to admit the severity and respond.” 

Jamieson O’Reilly, the laminitis of cybersecurity steadfast Dvuln, arrived astatine the aforesaid decision in a station connected X analyzing Hugging Face’s report. 

“That is the nonstop spread betwixt seeing and stopping,” O’Reilly wrote. “The strategy observed the onslaught and adjacent understood it, and thing turned that knowing into an involution rapidly enough.”

Ryan explained that decently implemented techniques specified arsenic defense-in-depth — a strategy that leverages respective layers of cybersecurity measures — should person fixed Hugging Face aggregate chances to drawback the attack. 

“A beardown modern information programme should inactive beryllium capable to interruption an onslaught similar this astatine aggregate points done defence successful depth, slightest privilege, segmentation, bully detection, reliable escalation, and continuous violative investigating to find the gaps,” Ryan explained.  

As O’Reilly enactment it, “none of that is exotic, and nary of it depends connected the attacker being an AI,” fixed that the techniques utilized successful the onslaught were “old.” 

What depended connected the attacker being AI, successful a way, was that OpenAI’s cause had not been instructed to beryllium stealthy. “The cause was not being sloppy. It simply had nary crushed to beryllium quiet. Nobody asked it to be. The nonsubjective was to bash good astatine the task,” said Nico Waisman, the main accusation information serviceman astatine XBOW, a startup that makes AI bug hunters. 

Waisman besides pointed retired that Hugging Face’s biggest mistake was that 1 azygous stolen credential gave OpenAI’s cause precocious privileges connected respective of its systems. 

All that being said, arsenic the aged adage goes, attackers lone person to triumph once, and defending against hackers of immoderate benignant is not easy. 

“Hugging Face could’ve done much detections but to beryllium just not each [organizations] are doing that well,” said Vincent Yiu, managing manager astatine SYON Security. “It’s not casual to big infrastructure and past arsenic a concern successful 2026. There’s hackers everywhere.”

According to Vlad from RunSybil, who said they person done incidental responses astatine Mandiant and Meta successful the past, Hugging Face appeared to instrumentality “reasonable measures fixed their knowing of what models are susceptible of.” 

“It is truly hard to classify what is simply a malicious enactment you should alert on, versus what is idiosyncratic conscionable doing their job,” Vlad said. “The measurement unsocial is not needfully a reddish flag.”

Dan Guido, the CEO of cybersecurity probe steadfast Trail of Bits, told TechCrunch that OpenAI deserves immoderate blasted for not having realized the onslaught was ongoing for days, portion HuggingFace deserves recognition for yet detecting the onslaught connected their own.

“The hard portion utilized to beryllium recognizing a blase attack, but present the hard portion whitethorn beryllium pulling the existent onslaught retired of the sound that the attacker throws on the way,” said Guido. “Nobody is going to work 17,000 reconstructed actions by manus to enactment retired what happened, truthful Hugging Face had to physique tooling conscionable to reconstruct the timeline.”

And to bash that, the institution needed its ain AI. Hugging Face said it had to usage the unfastened root exemplary GLM 5.2 from Chinese institution Z.AI aft it was blocked from utilizing frontier models due to the fact that of their safeguards, which, arsenic the institution enactment it, “cannot separate an incidental responder from an attacker.”

At that point, Hugging Face combined AI and humans to analyse OpenAI’s LLM-powered hacker. That’s a comparatively caller situation. But beyond that, the incidental shows that old-fashioned concepts and methods of antiaircraft cybersecurity tin inactive spell a agelong mode to support and combat against AI hackers.