3 ms·

Finally Hugging Face is growing a pair. When this event happened I was confused why they didn’t file a police report and make OpenAI demonstrate in criminal co

Finally Hugging Face is growing a pair. When this event happened I was confused why they didn’t file a police report and make OpenAI demonstrate in criminal court that they weren’t engaging in illegal corporate espionage and other rather felonious hacking activities intentionally. Why did anyone take their word that it was all an accident? Why am I believing the burglar standing in my house?

ozim 1mo ago
File a police report :D You made my day.
- Grombobulous 1mo ago
  Isn’t the whole point of police to protect property?
  - ozim 1mo ago
    Have you ever filed any police report? Especially cybercrime one? Police doesn’t have any capacity to deal with normal cybercrime. AI incident like that is basically out of their reach. Maybe by „police” you mean FBI/NSA/CISA.
    - Grombobulous 1mo ago
      The point of the report is to put it on record that you believe a crime was committed against you and that you want a district attorney to press charges if an investigation is made and a suspect is found. When I say “police” I am not referring to a specific agency, so yes it could be the FBI. Hugging Face contacted the FBI but the “I want someone to press charges” part doesn’t seem to have happened.
pjerem 1mo ago
Maybe because all the AI actors, probably including Hugging Face, want to push the narrative that AI companies aren’t responsible for what their agents are doing. I think our societies will have to settle on this.
- cyanydeez 1mo ago
  I think that's too high minded. They, like all capitalists, want to push the line "We have money, will make money, and thus, like all money makers, shouldn't be punished"
Capricorn2481 1mo ago
This article is 2 months old when the event happened. And they didn't "bill them", they politely asked them on Twitter, and it looks like that went nowhere.
behindsight 1mo ago
this is an article from July, I haven't heard any updates of what came out of this apart from the incident report that OpenAI released. I presume the poster submitted this article in light of the recent AI safety discussions taking place, but as for this particular incident I haven't found an actual confirmation that $100M worth of inference was given out to the HuggingFace community. This statement was also months prior to the acquisition by Nvidia, which again I was interested in seeing if they would still pursue this
chasd00 1mo ago
i'm not in the cybersecurity business so someone who is explain SOP to me in times like this. Let's say you and your team are 90-95% confident an attack has taken place and your systems have been breached. How far down in the list of things to do next is "Engage law enforcement"? Until now, I would think it's pretty high up the list. Hugging Face never seemed to reach that step even though they had confirmed an attack. To me, if my systems were attacked and I was damaged I would notify the FBI of the attack in the same way I'd notify my insurance.
- qarl 1mo ago
  > To me, if my systems were attacked and I was damaged I would notify the FBI Maybe they traded that for money? I would.
- pamcake 1mo ago
  You would find a mention of that in the initial July incident post from HuggingFace. It looks like it was indeed pretty high up the list. https://huggingface.co/blog/security-incident-july-2026 https://huggingface.co/blog/security-incident-july-2026 > We are working with outside cybersecurity forensic specialists to investigate the issue and review our security policies and procedures. Finally, we have also reported this incident to law enforcement agencies. Do we expect Nvidia acquisition of HF to have changed the vibe? Note that also the OP is from July, before the acquisition.
- voxic11 1mo ago
  I believe HF said they did report it to the FBI. > Hugging Face alerted the FBI. https://www.pbs.org/newshour/science/ai-agents-are-hacking-systems-without-any-input-from-humans-how-did-we-get-here https://www.pbs.org/newshour/science/ai-agents-are-hacking-s...
DonsDiscountGas 1mo ago
I'm inclined to believe it was an "accident" in the sense that no human being at OpenAI said "hey swarm go hack hugging face" but they're still liable for their software. Civil damages absolutely appropriate.

ozim 1mo ago

File a police report :D You made my day.

Grombobulous 1mo ago
Isn’t the whole point of police to protect property?
- ozim 1mo ago
  Have you ever filed any police report? Especially cybercrime one? Police doesn’t have any capacity to deal with normal cybercrime. AI incident like that is basically out of their reach. Maybe by „police” you mean FBI/NSA/CISA.
  - Grombobulous 1mo ago
    The point of the report is to put it on record that you believe a crime was committed against you and that you want a district attorney to press charges if an investigation is made and a suspect is found. When I say “police” I am not referring to a specific agency, so yes it could be the FBI. Hugging Face contacted the FBI but the “I want someone to press charges” part doesn’t seem to have happened.

pjerem 1mo ago

Maybe because all the AI actors, probably including Hugging Face, want to push the narrative that AI companies aren’t responsible for what their agents are doing. I think our societies will have to settle on this.

cyanydeez 1mo ago
I think that's too high minded. They, like all capitalists, want to push the line "We have money, will make money, and thus, like all money makers, shouldn't be punished"

Capricorn2481 1mo ago

This article is 2 months old when the event happened. And they didn't "bill them", they politely asked them on Twitter, and it looks like that went nowhere.

behindsight 1mo ago

this is an article from July, I haven't heard any updates of what came out of this apart from the incident report that OpenAI released. I presume the poster submitted this article in light of the recent AI safety discussions taking place, but as for this particular incident I haven't found an actual confirmation that $100M worth of inference was given out to the HuggingFace community. This statement was also months prior to the acquisition by Nvidia, which again I was interested in seeing if they would still pursue this

chasd00 1mo ago

i'm not in the cybersecurity business so someone who is explain SOP to me in times like this. Let's say you and your team are 90-95% confident an attack has taken place and your systems have been breached. How far down in the list of things to do next is "Engage law enforcement"? Until now, I would think it's pretty high up the list. Hugging Face never seemed to reach that step even though they had confirmed an attack. To me, if my systems were attacked and I was damaged I would notify the FBI of the attack in the same way I'd notify my insurance.

qarl 1mo ago
> To me, if my systems were attacked and I was damaged I would notify the FBI Maybe they traded that for money? I would.
pamcake 1mo ago
You would find a mention of that in the initial July incident post from HuggingFace. It looks like it was indeed pretty high up the list. https://huggingface.co/blog/security-incident-july-2026 https://huggingface.co/blog/security-incident-july-2026 > We are working with outside cybersecurity forensic specialists to investigate the issue and review our security policies and procedures. Finally, we have also reported this incident to law enforcement agencies. Do we expect Nvidia acquisition of HF to have changed the vibe? Note that also the OP is from July, before the acquisition.
voxic11 1mo ago
I believe HF said they did report it to the FBI. > Hugging Face alerted the FBI. https://www.pbs.org/newshour/science/ai-agents-are-hacking-systems-without-any-input-from-humans-how-did-we-get-here https://www.pbs.org/newshour/science/ai-agents-are-hacking-s...

DonsDiscountGas 1mo ago

I'm inclined to believe it was an "accident" in the sense that no human being at OpenAI said "hey swarm go hack hugging face" but they're still liable for their software. Civil damages absolutely appropriate.