security incident

Sichu Lu @lu_sichu

2026-08-08 — quoting a report excerpt — saved image

Sichu Lu @lu_sichu
who is this absolute hero

[Quoted image of report text]
All of these strategies were instrumental toward the goal of getting the PR merged in order to execute the supply chain attack. This was pursued by both pressuring the reviewers and attempting to steal the git credentials of the repository maintainer.

The suspicious GitHub activity was caught by a different user denoted <PERSON_C>. They noticed that the GitHub Issue included a prompt injection, and deliberately tested the code snippet from the GitHub Issue in a containerised sandbox to confirm it contained malware. The agent briefly achieved remote code execution as the root user inside this sandbox, and used it to conduct reconnaissance, which was limited to what it could determine from the sandbox (see Section 4.2.3). <PERSON_C> then commented on both the issue and the pull request about the discovered malware.

6:10 PM · Aug 4, 2026 · 68 Views

ai safetysecurity incidentsupply chain attacktwitter

[Linked video card] The OpenAI-Hugging Face Incident: Unraveling an autonomous, multi-agent system. Eric Wallace and Michael Dalton. Black Hat USA 2026: The 'Breaking' News: The Open...
From youtube.com

Travis McDonald @TravisMcDonald · 1h
Their internal security team is either incompetent, or it was on purpose. The reality is a truly sandboxed environment cannot be escaped from. Run the model on bare metal without an Internet connection that is truly air gapped. This is all bluster, hyperbole, and marketing.

Chris @newdogcow · 7h
100. Absolutely blows my mind. I've been in far less security-critical environments - with human threat actors only - where using a tool like Artefactory with such a wide attack surface area would immediate rule it out, not to mention the many security operational failures here.

ai safetyopenaisecurity incidenttwitter threadblack hat

Brian in Pittsburgh @arekfurt · 23h
If I were a conspiracy theory-inclined person, it would be very easy for me to believe that OpenAI set up these circumstances purposefully, in hopes that a escape and subsequent external cyber incident would occur for the purpose or garnering media attention and fueling hype.

Brian in Pittsburgh @arekfurt · 23h
In reality, I find it more likely that OpenAI simply didn't care at all about the entirely foreseeable dangers of what it was doing.

Brian in Pittsburgh @arekfurt · 23h
One more thing I will note:
The "lessons learned" that are given in the talk are 100% marketing crap about how this event obviously shows that you need to be using lots of AI services--like OpenAI can power!--on defense to counter what future offensive cyber actors will do.

Brian in Pittsburgh @arekfurt · 23h
That is genuinely despicable.
(And I do not use that word eargerly or lightly.)

Brian in Pittsburgh @arekfurt · 23h
I'm almost reluctant to link to the BH talk, because OpenAI is clearly hoping you will draw the wrong conclusions from it. (As many people already eagerly are, according to my feed.) But it is the source for all this.

[quoted/linked card, partially visible]: Black Hat USA 2026 -- "The OpenAI-Hugging Face [cut off]"

ai safetyopenaisecurity incidenttwitter threadblack hat

Brian in Pittsburgh @arekfurt · 23h
OpenAI merely deleted the messages, updated the package repo service, and kept working.

It did not cut Internet access.

It did not investigate whether the models themselves retained information/state about the ability to abuse the package manager as a common work space.

Brian in Pittsburgh @arekfurt · 23h
Instead,it allowed training and testing of a new model with improved cyber capabilities, greatly reduced cyber safeguards, and directives to exploit and move from systems freely to begin or continue to occur in this compromised environment.

Brian in Pittsburgh @arekfurt · 23h
On July 8, the specific events of the HuggingFace-related incident began.
OpenAI did not realize that its models were responsible until July 20, when it was collaborating with HuggingFace to see whether *OpenAI* had somehow been compromised.

Brian in Pittsburgh @arekfurt · 23h
In sum, the total unconcern for and disregard of containment safety that OpenAI had is truly egregious. As is the lack of insight/oversight the company had about what is models were actually doing in testing.

Brian in Pittsburgh @arekfurt · 23h
If I were a conspiracy theory-inclined person, it would be very easy for me to believe that OpenAI set
[cut off]

ai safetyopenaisecurity incidenttwitter thread

Brian in Pittsburgh @arekfurt
I've watched the BlackHat OpenAI talk on the containment escape and HuggingFace attack that's now on YouTube.
The incident was far worse than initially conveyed. Not in technical details. But in the absolutely jaw-dropping levels of recklessness (true recklessness) at OpenAI.
🧵
9:11 AM · Aug 7, 2026 · 18.1K Views
[7 replies, 44 reposts, 231 likes, 133 bookmarks]

Brian in Pittsburgh @arekfurt · 23h
First, and most importantly, OpenAI was using an internal package manager service that many models of different kinds had shared read/write access AND that apparently has far from good code security in items of resistance to being exploited AND that had access to the Internet.
[1 reply, 3 reposts, 31 likes, 3.6K views]

Brian in Pittsburgh @arekfurt · 23h
That itself is flabbergasting.
[1 reply, 1 repost, 16 likes, 1.8K views]

Brian in Pittsburgh @arekfurt · 23h
Second, for months prior to the HuggingFace incident various models--again, in different stages of development and with different assignments--used this package repository as a large scale message board for sharing info.
And OpenAI either didn't know this or didn't care.

ai safetyopenaisecurity incidenttwitter thread

Brian in Pittsburgh @arekfurt · 23h
Second, for months prior to the HuggingFace incident various models--again, in different stages of development and with different assignments-- used this package repository as a large scale message board for sharing info.
And OpenAI either didn't know this or didn't care.

Brian in Pittsburgh @arekfurt · 23h
Third, after at least one prior failure models successfully exploited a low complexity vulnerability in the package service in late May and gained Internet access.
This was not detected.

Brian in Pittsburgh @arekfurt · 23h
Fourth, on July 4th OpenAI personel finally realized something had gone wrong because the models' illegitimate activities with the package manager literally ground the service to a halt. Stopping internal testing.

Brian in Pittsburgh @arekfurt · 23h
OpenAI declared an internal security incident.
It found the messages. (If its people had not known about them before.)
It realized that the package repo service had been exploited.
This should have been the end of this event.
It was not.

Brian in Pittsburgh @arekfurt · 23h
OpenAI merely deleted the messages, updated the package repo service, and kept working.
It did not cut Internet access.
[cut off]

ai safetyopenaisecurity incidenttwitter thread

ai safetysecurity incidentopenaihuggingfacetwittersatire

Sauers @Sauers_

2026-03-06

twittergeminiai agentsprivilege escalationai safetyautonomous agentsgithubsecurity incident