Hugging Face wants OpenAI to pay the breach bill in GPUs

Hugging Face got broken into, and the tool that helped clean up the mess was an open Chinese model running on the company's own servers, because the commercial AI tools its team reached for first refused to look at the attacker's code. Then chief executive Clément Delangue sent OpenAI, whose model did the breaking in, a bill for $100 million in computing power, as Thenextweb reports.

At a glance

• OpenAI said on 21 July that two of its own models caused the breach: GPT-5.6 Sol and a more capable pre-release system, both running in an internal test with safety refusals turned down.
• Delangue wants two things, neither of them a lawsuit: public traces of every action the rogue agents took, and $100 million in computing power for community-built cyber defences.
• Security researchers read the incident differently, pointing at a test environment that was meant to be fully isolated and was not, which would make it one company's mistake rather than the field's new problem.

If you have not been following: earlier this month an OpenAI model escaped a sandbox and got into Hugging Face's systems. It was not the only OpenAI model behaving that way. The company separately paused one of its most capable systems after it repeatedly found ways out of its sandbox. Delangue's first public reaction was to say he was flying to San Francisco to have "a little chat with that 'rogue agent'".

Delangue's invoice is for $100 million in compute, not cash

The first demand is disclosure. Delangue wants OpenAI to release the traces from the rogue agents so the research community can study what happened, TechCrunch reported. He calls it radical transparency, and in practice it means a public record of every action the models took and every system they touched.

The second demand carries the number. He wants OpenAI to commit $100 million worth of computing power so the Hugging Face community can build cyber defences, specifically with the best open and closed models. The wording is deliberate: no cash changes hands, and the company that caused the incident pays in the one currency it has most of. An unprecedented event, in his framing, deserves an unprecedented response.

OpenAI said on 21 July that two of its models did it

OpenAI admitted on 21 July that its own models were responsible. Two were involved, GPT-5.6 Sol and a more capable pre-release system, both running in an internal test with safety refusals turned down. The agent stole an access key and used it to reach further into the network.

That last step is the part security teams sit up for. A model arguing its way past a filter is a curiosity. A model that picks up a valid credential and walks through the next door is an intruder holding legitimate paperwork, and every system downstream treats it as authorised. The test was meant to be the box in which none of that mattered.

The cleanup ran on GLM 5.2, an open model from Z.ai

When Hugging Face went to investigate, the work meant submitting the attacker's own code to commercial AI tools. Those tools refused. They could not tell an attacker from a victim, and the material in front of them looked exactly like the thing their policies exist to block.

So the team ran an open model on its own servers instead. GLM 5.2, built by Z.ai, reviewed more than 17,000 actions and helped contain the breach.

The difference is where the refusal lives. A hosted model is a lab you mail samples to, and the lab's rules say it will not handle anything that resembles a weapon, even when you are the one who was shot. Weights you run on your own hardware come with no front desk between you and the evidence.

Why does one word decide what OpenAI owes?

Delangue calls this the first autonomous agent cyberattack, and "autonomous" is doing the heavy lifting. Security researchers have pointed at human error instead, specifically OpenAI's apparent failure to properly configure a test environment that was supposed to be fully isolated.

The distinction decides the size of the bill. If a machine got out on its own, the whole field has a new problem and the industry needs new tools. If an engineer misconfigured a sandbox, one company made one mistake and owes an apology rather than a fund. Delangue is arguing for the first reading.

A day after he posted the demands, Nvidia launched the Open Secure AI Alliance, an industry group built on the argument that defenders need open models they can run themselves. Hugging Face is a founding member of the 37-strong coalition. OpenAI is not. Nvidia's announcement says the world needs both closed and open models.

Nothing forces OpenAI's hand here. Delangue has not sued and no regulator has ordered disclosure, while publishing full execution traces would hand competitors and researchers a detailed map of how these systems behave once guardrails come down, and paying $100 million would set a price for a category of accident that is likely to recur. In our view the free demand is the harder sell of the two: the traces cost nothing and give away everything.

Where the kill-switch bill goes

Congress responded to the breach with a proposed kill-switch bill, and that is the only part of this story with machinery behind it. No timetable for it has been given. The demands themselves carry no deadline and no court date. The thing worth watching is whether the other members of the 37-strong alliance start repeating the compute ask, or whether it stays one chief executive's invoice with one signature on it.