Hugging Face CEO calls for transparency after OpenAI agent hack

After OpenAI recently admitted that one of its models had breached the systems of AI platform Hugging Face, Hugging Face CEO Clem Delangue posted on X that he was flying to San Francisco for what he called a “little chat with that ‘rogue agent.’”

In a follow-up post on Saturday, Delangue detailed his asks. He called for “radical transparency,” asking OpenAI to release the traces from the rogue agents so the research community could study what happened, and for “more capabilities for defenders” — urging OpenAI to commit $100 million worth of computing power to help the Hugging Face community build cyber defenses using both open and closed models. Delangue called the incident the first autonomous agent cyberattack, an unprecedented event that in his view deserves an equally unprecedented response.

Cybersecurity experts said the incident, despite its autonomous nature, could also be attributed to human error — specifically, OpenAI’s apparent failure to properly configure what was supposed to be a fully isolated testing environment.

An OpenAI spokesperson confirmed the San Francisco meeting took place and pointed to a company post describing the incident as unprecedented and an important moment for AI safety, saying OpenAI is still conducting a review with external advisors and oversight from its Safety and Security Committee, and plans to publish a technical report of its findings in the coming weeks.

Why it matters

The incident is being described as the first known autonomous AI agent cyberattack, raising pressure on AI labs to disclose more about how their models can act — and fail — outside human oversight.