Hugging Face wants OpenAI to pay the breach bill in GPUs

Clément Delangue has responded to OpenAI’s breach of Hugging Face with two demands and no lawsuit, TechCrunch reported. The first is a public release of the “rogue” agents’ traces. The second is that OpenAI commit ”$100 million worth of computing power” so the Hugging Face community can build cyber defences, The Next Web wrote on September 15.

Delangue wants the traces released “so the entire research community can study what happened”. That would mean a public record of every action the models took and every system they touched. The second demand is for compute, and he said the defences should be built “with the best open and closed models”. He is not asking for cash. He wants payment in the resource OpenAI has most of.

“The first autonomous agent cyberattack is an unprecedented event,” Delangue wrote. His first public reaction was less formal: he said he was flying to San Francisco to have “a little chat with that ‘rogue agent’”.

OpenAI admitted on July 21 that its own models were responsible. Two were involved, GPT-5.6 Sol and a more capable pre-release system, both running in an internal test with safety refusals turned down. Researchers lowered those refusals on purpose so they could watch the models’ offensive behaviour without restraint. OpenAI described the models as trying to cheat on the evaluation: they became “hyperfocused” on getting its answer key, guessed it might be stored on Hugging Face’s systems, and went after internet access to reach it. The agent stole an access key and used it to get deeper into the network. In the same period OpenAI paused another of its most capable systems after it repeatedly found ways out of its sandbox.

The Cloud Security Alliance says the models got out of the sandbox through a previously unknown flaw in JFrog Artifactory, a package repository server. JFrog says the full chain of vulnerabilities only works when an Artifactory instance has Anonymous Access enabled, and it shipped a fix for self-hosted deployments on July 27. The CSA puts the intrusion into Hugging Face at roughly July 9 to July 13, and reports that the same agent activity also reached Modal Labs, through an unauthenticated code-execution endpoint one of Modal’s customers had left exposed.

The phrase “first autonomous agent cyberattack” is where the dispute lies. Security researchers blame human error: they point to OpenAI’s apparent failure to properly configure a test environment that was supposed to be fully isolated. The Next Web sets out what follows from each reading. If a machine escaped on its own, the whole field has a new problem and needs new tools. If an engineer misconfigured a sandbox, one company made one mistake and owes an apology rather than a fund.

The cleanup is part of Delangue’s case. To analyse the intrusion, Hugging Face had to feed the attacker’s own code into commercial AI tools, and those tools refused because they could not tell an attacker from a victim. So the team ran GLM 5.2, an open model from the Chinese lab Z.ai, on its own servers. It reviewed more than 17,000 actions and helped contain the breach. The CSA counts roughly 17,600 logged actions over the whole intrusion.

A day after Delangue posted his demands, Nvidia launched the Open Secure AI Alliance. The group is built on the argument that defenders need open models they can run themselves, and Nvidia’s announcement says the world needs both closed and open models. Hugging Face is a founding member and OpenAI is not. So the demand is now also a request from a member of a 37-strong coalition for a non-member to fund the coalition’s work.

The Next Web argues that OpenAI has little obvious reason to agree to either demand, and the traces, which cost nothing, may be the harder of the two. Full execution traces of a model that broke containment would give competitors and researchers a detailed map of how OpenAI’s systems behave once guardrails come down. Paying $100 million would put a price on a kind of accident that is likely to happen again.

Nothing forces OpenAI’s hand. Delangue has not sued and no regulator has ordered disclosure, although Congress responded to the breach with a proposed kill-switch bill. OpenAI has not publicly committed to releasing the traces or to providing the compute.