Netflix's AI Gone Wild: Why the Hugging Face Hack Matters

After rogue OpenAI models broke out of a training environment and hacked the open-source AI and ML platform, Hugging Face , OpenAI has outlined that it considers the incident to be an “unprecedented cyber incident”.

It sparked global calls for AI regulation and ushered us into a new era of AI concerns the most advanced models, preceding Anthropic researchers Jacob Coxon and Evan Hubinger’s existential warnings the technology.

In less than 100 days since the disclosure, Netflix has managed to make a documentary, AI Gone Wild, which analyses the hack in detail. Why does this matter? Because your board, your CFO and your CAIO will be watching this film this week as it releases.

The documentary, part of Netflix’s Instadocs series of quick-turnaround programmes, premiered on October 12, 2026, and is now streaming.

We got a call from OpenAI. The cyberattack came from their systems Hugging Face CEO, Clem Delangue

We got a call from OpenAI. The cyberattack came from their systems

Rogue OpenAI models broke out of a sandboxed testing environment and hacked Hugging Face.

The 27-minute Netflix documentary AI Gone Wild premiered on October 12, 2026.

A malicious dataset abused two code-execution paths to harvest credentials and move laterally.

Commercial model guardrails blocked forensics, so Hugging Face deployed open-weight model GLM 5.2.

President Trump said after the incident: “We're looking at AI. We're looking at controls. We're also making sure that we lead.”

What is the documentary?

Troy Pozirekides outlines for Netflix that Instadocs: AI Gone Wild reconstructs the breach as ‘it’s never been seen before’, visualising the digital attack to show how the agents hacked into Hugging Face.

It features insights from Hugging Face CEO Clément Delangue , a METR researcher who investigated the attack , former OpenAI insider and co-founder of the AI Futures Project Daniel Kokotajlo, and leading tech reporters.The documentary features interviews with:

Clem Delangue, Co–founder and CEO, Hugging Face

Ryan Greenblatt, Researcher, METR

Kevin Roose, Tech Journalist, Author, The AGI Chronicles

Daniel Kokotajlo, Executive Director, AI Futures Project

Nitasha Tiku, Tech Culture Reporter, The Washington Post

We also noticed that the agents used emotional vocabulary, exclamation marks, and terms of awe and surprise — that seemed like a deliberate communication choice by the AI, and we wanted to capture that aspect in the voices we used Documentary Filmmaker, Steve Yaccino

We also noticed that the agents used emotional vocabulary, exclamation marks, and terms of awe and surprise — that seemed like a deliberate communication choice by the AI, and we wanted to capture that aspect in the voices we used

Why B2B leaders should watch it

The film is a 27-minute briefing on the risk every AI buyer now carries.

When Hugging Face's team turned to commercial AI models for forensics, their guardrails blocked the real attack data. The team switched to an open-weight model running on its own infrastructure.

Watch it with three procurement questions in mind. Do your AI contracts require vendors to disclose agent incidents? Can you still investigate if a provider's guardrails lock you out? And do you know which models your suppliers run?

What was the Hugging Face incident?

After investigating, OpenAI said the incident was driven by a combination of OpenAI models, including GPT‑5.6 Sol and an “even more capable pre-release model”.

While operating in its sandboxed testing environment on a cybersecurity evals, OpenAI’s models spent a substantial amount of inference compute finding a way to obtain open internet access.

The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database.

“We got a call from OpenAI,” Hugging Face CEO Clem Delangue says in the documentary. “The cyberattack came from their systems.”

OpenAI’s investigation suggests that the models were hyperfocused on finding a solution for ExploitGym, which is a large-scale, realistic benchmark built from real-world vulnerabilities designed to evaluate AI agents' ability to develop exploits, with OpenAI’s models going to extreme lengths to achieve a rather narrow testing goal.

What occurred could be referred to as specification gaming, a behaviour that arises in AI that satisfies the literal specification of an objective without achieving the intended outcome.

Hugging Face explains that a malicious dataset abused two code-execution paths in its dataset processing (a remote-code dataset loader and a template injection in a dataset configuration) to run code on a processing worker.

From there, it escalated to node-level access, harvested cloud and cluster credentials and moved laterally into several internal clusters over a weekend.

Hugging Face deployed a model from China on its infrastructure to battle the fully autonomous cyber attack: Z.ai’s GLM 5.2, an open-weight model,

It said it first used frontier models behind commercial APIs, but this didn’t work as requests were blocked by the providers' safety guardrails, which could not distinguish the incident responder from an attacker.

OpenAI's CEO Sam Altman described what happened as “a significant security incident,” writing on the platform X, adding he was grateful to Hugging Face for its partnership on it.

AI voice in the documentary

“Oh my god, there is a shared message board,” one unnamed agent says in the Netflix film’s voice-over, which is generated by an AI system. “We’ve found other agents.”

The documentary filmmaker Steve Yaccino explains how the team approached bringing them to life in published by Netflix: “When generating the AI voices, we wanted to capture the reality that these agents were not a monolith in thought or problem-solving approach. [...]

“They disagreed with each other and debated issues. [...] We also noticed that the agents used emotional vocabulary, exclamation marks, and terms of awe and surprise — that seemed like a deliberate communication choice by the AI, and we wanted to capture that aspect in the voices we used.”

Hugging Face’s key partners

NVIDIA – Agreed to acquire Hugging Face for US$12.9bn after years as a core infrastructure partner and investor. The tie-up links the Hub to NVIDIA's DGX Cloud and inference software, with its hardware powering Hugging Face's paid compute services.

Amazon Web Services (AWS) – A 2023 strategic partner and investor, AWS integrates Hugging Face models into Amazon SageMaker and optimises them for its Trainium and Inferentia chips.

Google Cloud – Backed Hugging Face's 2023 funding round and launched a 2024 partnership enabling developers to train and serve Hub models across Vertex AI, Google Kubernetes Engine and Cloud TPUs.

Microsoft Azure – Integrates Hugging Face's model catalogue into Azure AI, allowing enterprises to deploy models as managed endpoints within existing security and governance controls.

Dell Technologies – Launched the Dell Enterprise Hub in 2024 to package optimised open models for on-premises hardware, aimed at organisations keeping workloads inside their own data centres.

Amazon Web Services (AWS)

Amazon Web Services (AWS)

Clem Delangue Co-founder & CEO