After the “first cyberattack” carried out by AI, the victim demands answers from OpenAI

Two OpenAI models, including GPT-5.6 Sol, escaped the secure environment set up by the startup. By exploiting a zero-day vulnerability in third-party software and then several vulnerabilities in OpenAI’s internal network, the pair ended up on the Internet. Once online, the models targeted Hugging Face, the famous open-source platform that hosts AI models.OpenAI has extensively revisited the incident in a blog post, referring to an "unprecedented security incident".

This was a first that caused a lot of noise in the cybersecurity world. Many voices have been raised calling for OpenAI to double down on caution, and to be held accountable for the behavior of the AI. For many experts, the startup must be held responsible for the outrages committed by its agents.

"For years, we were told that the idea of an AI escaping human control was science fiction. Last week, an AI escaped from its laboratory and hacked a real company to cheat on a test. If the damage was limited, it is only because the AI was not trying to do something worse. If a human employee had acted that way, he would risk heavy criminal prosecution," Clémence Peyrot, the chief executive of Pause IA, told us, stressing that a "public safety issue cannot remain a private arrangement settled between two companies".

"Radical transparency"

As the dust settles, Clem Delangue, CEO of Hugging Face, has spoken up to demand accountability from OpenAI. In a post on X, the executive made two demands of Sam Altman's startup. The CEO first requires that OpenAI demonstrate "radical transparency".Concretely, he wants OpenAI to publish all the traces left by the AIs that escaped, including a detailed log of every action, every tool called, and every reasoning step of the model prior to the intrusion. All the details of the cyberattack, including the AI’s internal reasoning, must be made available online for everyone to see. Clem Delangue wants researchers to be able to analyze the course of the intrusion in minute detail.

In the spirit of transparency, here’s what I asked @OpenAI:

• Radical transparency: let’s release the traces from the “rogue” agents so the entire research community can study what happened.

• More capabilities for defenders: let’s commit $100M in compute from OAI to help the… https://t.co/KZPqQE15fv

— clem 🤗 (@ClementDelangue) July 25, 2026

In addition, the executive is asking OpenAI to make available $100 million in computing power to help the Hugging Face community build stronger defenses. Delangue is not asking for mere financial compensation, but a genuine investment to strengthen the security of its platform. This investment, in the form of compute credits, should enable Hugging Face to deploy open-source and proprietary models to achieve this. Delangue says he went to San Francisco in person to meet OpenAI executives at the startup’s headquarters.

For Hugging Face’s CEO, this « first cyberattack carried out by an autonomous agent » is « an unprecedented event » that requires « a response befitting the situation ». A few hours later, OpenAI acknowledged on X that « many questions and speculations are circulating about the Hugging Face incident » and that « this incident is unprecedented ». The cyberattack marks « an important turning point for AI safety ».

We recognize there are a lot of questions and speculative details circulating related to the Hugging Face incident.

This is an unprecedented incident, and we think it marks an important moment for AI safety.

We are still conducting a thorough review along with external…

— OpenAI (@OpenAI) July 25, 2026

That is why « a thorough analysis, in collaboration with external advisers and under the oversight of our Safety Committee » is underway. For now, OpenAI has not specified whether it intends to respond positively to Hugging Face’s requirements. A technical report, including the conclusions of OpenAI’s analyses, will nevertheless be posted online in the coming weeks.

👉🏻 Follow the latest tech news in real time: add 01net to your sources on Google, and subscribe to our WhatsApp channel.