In the Hugging Face breach, OpenAI’s hacker was noisy and fast — but not unstoppable

Earlier this month, AI dataset platform Hugging Face shocked the world when it revealed that it had fallen victim to a fully autonomous AI-powered cyberattack. Days later, the story took another dramatic twist when OpenAI admitted that the hacker behind the breach was one of its AI models, which broke out of a testing environment and into protected Hugging Face systems in an effort to circumvent a benchmark. It’s an alarming incident for anyone even slightly concerned about rogue AI models — and the days since the event have been full of predictions about a new cybersecurity paradigm in which AI models launch attacks so strong that only other AI models can defend against them.  But despite the justified alarm, the paradigm may not have shifted quite as much as it seems. Experts who spoke to TechCrunch stressed that OpenAI’s agent largely operated like a human — with some caveats — and that better implemented traditional defensive techniques could have helped stop the attack. In short, we may already have the tools to defend against this kind of attack; we just aren’t using them properly. Hugging Face made a version of this point in its incident report, stating that the weaknesses exploited in the attack “were familiar,” and “a capable human attacker could have found and exploited the same flaws.” Kyle Ryan, the head of R&D at Pensar, a startup that develops continuous hacking AI agents, and Vlad Ionescu, the co-founder and CTO of RunSybil, a startup that builds AI-powered bug hunters, both agreed and told TechCrunch that the techniques used in the attack would be the same ones employed by a human or a group of human red teamers. That is, hackers tasked with attacking a system to help the company that owns it improve defenses. What was very non-human-like was the speed, scale, and relentlessness of the attack. As Hugging Face explained, OpenAI’s agent performed 17,600 actions over four and a half days: It broke in, did reconnaissance, stole passwords and code, and moved around the company’s infrastructure.  “What’s impressive is the autonomy and endurance,” Ryan said. “That kind of sustained, adaptive operation is what stands out most to me.”  var playerInstance_jwplayer_6a6bedf1102dc = jwplayer( "jwplayer_6a6bedf1102dc" ); playerInstance_jwplayer_6a6bedf1102dc.setup({ playlist: "https://cdn.jwplayer.com/v2/media/4CEANrFT", }); Contact Us Do you any more information about OpenAI’s hack against Hugging Face? Or other AI-powered cyberattacks? We’d love to hear from you. From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. On the flip side, given the sheer number of actions over the span of several days, OpenAI’s agent was “insanely noisy,” as Ryan put it. Unlike a human, who could have been stealthier, the agent made a lot of noise, which should have tripped up Hugging Face’s defenses sooner, ideally leading to a human intervening and stopping the attack.  “I’d call it more of a defensive failure than exceptionally good offense. Hugging Face’s tooling actually correlated the activity into an attack signal, but failed to raise the criticality and page the on-call team, which cost them time,” Ryan explained. “From there, humans still had to recognize the severity and respond.”  Jamieson O’Reilly, the founder of cybersecurity firm Dvuln, arrived at the same conclusion in a post on X analyzing Hugging Face’s report.  “That is the exact gap between seeing and stopping,” O’Reilly wrote. “The system observed the attack and even understood it, and nothing turned that understanding into an intervention quickly enough.” Ryan explained that properly implemented techniques such as defense-in-depth — a strategy that leverages several layers of cybersecurity measures — should have given Hugging Face multiple chances to catch the attack.  “A stron