3 ms·

Two things don't add up here: 1. If huggingface has access to uncensored OAI models, how come they had to use GLM 5.2 to investigate the intrusion? 2. Once th

Two things don't add up here: 1. If huggingface has access to uncensored OAI models, how come they had to use GLM 5.2 to investigate the intrusion? 2. Once the model gains network access, can't it cheat to a perfect score by looking at the full dataset? Why go into the trouble of doing this kind of things: "In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers." Not saying this is marketing BS (this is after all, not Anthropic) but I feel OAI staff may be exaggerating a bit here.

throwfaraway4 3mo ago
I read it as _now_ they have access to the models but not during the intrusion
reverius42 3mo ago
I think it was the other way around, uncensored OAI models (run by OAI) got themselves (extra) access to HF?
paxys 3mo ago
Huggingface did not have access to the models. They were running in OAI’s infrastructure.
- throwa356262 3mo ago
  Ah, that makes more sense :) But then, why attack huggingface? The exploitgym dataset is on github and can be downloaded without need for exploits?
  - _ifton 3mo ago
    breadth search and found huggingface first? Pure speculation
john_strinlai 3mo ago
"The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database. [...] While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem. [...] After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation." escaped openai, hacked hugging face to get the solutions. your #2 is exactly what it was trying to do.
conradkay 3mo ago
https://huggingface.co/blog/security-incident-july-2026 https://huggingface.co/blog/security-incident-july-2026 They explain it here, basically for data security/privacy reasons

throwfaraway4 3mo ago

I read it as _now_ they have access to the models but not during the intrusion

reverius42 3mo ago

I think it was the other way around, uncensored OAI models (run by OAI) got themselves (extra) access to HF?

paxys 3mo ago

Huggingface did not have access to the models. They were running in OAI’s infrastructure.

throwa356262 3mo ago
Ah, that makes more sense :) But then, why attack huggingface? The exploitgym dataset is on github and can be downloaded without need for exploits?
- _ifton 3mo ago
  breadth search and found huggingface first? Pure speculation

john_strinlai 3mo ago

"The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database. [...] While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem. [...] After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation." escaped openai, hacked hugging face to get the solutions. your #2 is exactly what it was trying to do.

conradkay 3mo ago

https://huggingface.co/blog/security-incident-july-2026 https://huggingface.co/blog/security-incident-july-2026 They explain it here, basically for data security/privacy reasons