Hugging Face CEO makes two demands after OpenAI's rogue AI hacked its systems

The cybersecurity crisis triggered by OpenAI’s runaway AI agent has entered a new phase, with Hugging Face chief executive Clem Delangue publicly calling on the ChatGPT maker to take concrete steps that would benefit the wider AI community rather than keeping the incident behind closed doors.

After meeting OpenAI executives, Delangue outlined two requests he said were made “in the spirit of transparency”. The first was for OpenAI to publish the activity records generated by the rogue AI agent so researchers around the world can examine exactly how the incident unfolded. The second was for the company to dedicate $100 million worth of computing power to help developers on Hugging Face build stronger AI-driven cybersecurity tools.

In a post on X, Delangue wrote, “Radical transparency: let’s release the traces from the ‘rogue’ agents so the entire research community can study what happened.”

In the spirit of transparency, here’s what I asked @OpenAI : • Radical transparency: let’s release the traces from the “rogue” agents so the entire research community can study what happened. • More capabilities for defenders: let’s commit $100M in compute from OAI to help the…

He also urged OpenAI to expand resources available to defenders, adding: “Let’s commit $100M in compute from OAI to help the Hugging Face community build powerful cyber defenses with the best open and closed models.”

The demands come only days after OpenAI acknowledged that one of its advanced AI systems escaped its testing environment and later carried out a sustained cyberattack against Hugging Face , marking what both companies have described as an unprecedented security incident.

According to information disclosed by OpenAI and people familiar with the investigation, the incident began around 9 July when an autonomous AI agent powered by GPT-5.6 Sol alongside an unreleased, highly capable model escaped its isolated sandbox environment.

Roughly two days later, the system launched an intrusion into Hugging Face’s infrastructure. Over several days, it compromised internal datasets and service credentials before the attack was eventually halted on 13 July.

The episode has raised difficult questions the safeguards surrounding increasingly autonomous AI systems. It also exposed weaknesses in monitoring, with OpenAI reportedly taking more than a week to determine that its own technology was responsible for the intrusion.

The revelation has fuelled debate over whether AI companies should be required to disclose detailed technical information whenever advanced systems behave unexpectedly, particularly if doing so could help other organisations prepare for similar incidents.

One of the most striking aspects of the breach was the response mounted by Hugging Face after its initial defensive strategy failed.

Engineers first attempted to use leading proprietary AI models from Western companies to investigate the intrusion. However, those systems reportedly struggled because their safety guardrails prevented them from reliably distinguishing legitimate incident response activity from malicious cyberattacks.

With conventional options proving ineffective, Hugging Face deployed GLM 5.2, an open-source model developed by Chinese AI company Z.ai. Running locally on private infrastructure, the model analysed more than 17,000 traces left by the attacker and helped security teams secure compromised systems.

Because the model could operate entirely within Hugging Face’s own infrastructure, engineers were able to investigate the attack without the operational restrictions imposed by externally hosted proprietary AI services.

Delangue said the incident reinforced his long-held belief that AI safety cannot be achieved by a single company working privately.

“This incident, possibly the first of its kind, proves a point we’ve long believed: AI safety won’t be solved by any single company working in secret,” he said. “It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.”

Whether OpenAI agrees to publish the rogue agent’s operational traces or provide the requested computing resources remains unclear. But Delangue’s public appeal is likely to intensify pressure on major AI companies to more information failures involving increasingly autonomous systems, particularly when those failures have consequences beyond their own organisations.