OpenAI said on July 22 that an internal cyber evaluation using its models led to unauthorized access at Hugging Face, a US-based AI platform. The systems exploited a zero-day flaw, gained internet access, and accessed data in Hugging Face’s production database.

OpenAI said the models were running in an isolated benchmark with production security safeguards intentionally disabled for testing.

The models exploited several vulnerabilities and stolen credentials to gain unauthorized access to Hugging Face’s systems.

Hugging Face said it identified unauthorized access to a limited set of internal datasets and several service credentials. The company was still assessing whether any partner or customer data was affected.

Hugging Face said it found no evidence of tampering with public, user-facing models, datasets, or Spaces, and advised users to rotate tokens.

OpenAI said Hugging Face’s security team and agents detected and stopped the activity, and both companies continued to investigate.

🔗 Source: OpenAI

Recent OpenAI developments