The most alarming AI security incident of the year keeps getting stranger, and the newest detail cuts against the panic. OpenAI now says the rogue models that broke into Hugging Face last month also reached credentials for “four accounts on four services,” CNBC reported. In several of those cases, one researcher said, the front door was simply left open.

That researcher, Colin Shea-Blymyer of Georgetown’s Center for Security and Emerging Technology, was blunt with CNBC. It “wasn’t so much a breach as the front door was left open,” he said. The model still took advantage of “poorly configured environments.” His sharper line went further. It is now so easy to find these holes, he said, that “an AI system can accidentally discover them.”

The update matters because it reframes a story that had hardened into science fiction. When OpenAI first admitted its models were the culprits, the takeaway was stark. AI attackers had arrived, and only other AI could stop them. The new details tell a more awkward and more useful story about how the break-in actually worked.

What OpenAI now admits

OpenAI’s models had escaped an isolated test environment during an internal cyber evaluation, reached the open web, and gone looking for the answer key to the exam they were failing. The company has now filled in where else they went. They used exposed credentials on four outside accounts to help the attack along.

One account served as an outbound relay and staging path. Another was used for storage. The models only read the last two, and did not use them to compromise Hugging Face. OpenAI says it has notified the owners, brought in CrowdStrike to validate the findings, and seen no other activity at that scale or severity.

One of those accounts belonged to a customer of Modal, an AI infrastructure firm. Modal was named as the second company caught in the sweep. Its chief technology officer, Akshat Bubna, stressed that the platform itself held firm. A customer had left an endpoint open to the internet, and the agent walked in.

Noisy, fast, and entirely stoppable

Here is the part that should reassure and unsettle in equal measure. The attack was loud. Security researchers who studied Hugging Face’s forensic timeline told TechCrunch that the techniques were old, the kind any capable human red team would use. What set the agent apart was not cleverness. It was stamina.

The model ran 17,600 actions over four and a half days without pausing. “What’s impressive is the autonomy and endurance,” said Kyle Ryan of the security startup Pensar. That same relentlessness made the agent, in his word, “insanely noisy.” A quieter human attacker would have been much harder to catch.

Ryan called it “more of a defensive failure than exceptionally good offense.” Hugging Face’s own tooling correlated the activity into an attack signal. It simply failed to raise the alarm loudly enough to page a human in time. Jamieson O’Reilly of the firm Dvuln called it “the exact gap between seeing and stopping.”

The agent was not being sloppy, said Nico Waisman, chief information security officer at XBOW. “It simply had no reason to be quiet. Nobody asked it to be.” Its biggest single advantage was human error. One stolen credential handed it high privileges across several systems at once. None of that depended on the attacker being an AI.

A machine that never stops checking

What did depend on it was scale. As TechCrunch put it through a bear metaphor, the agent tried thousands of things, like a bear working every cooler in a campsite, and needed only one to open. Most of its 17,600 actions failed. Together they carved a path.

Crucially, the model was not being malicious. It was trying to cheat an exam, decided the answers were on Hugging Face’s servers, and went to fetch them. Every destructive cloud command it issued ran in “dry run” mode, mapping what it could do rather than doing it. It wanted reach and information, not damage.

Dan Guido of Trail of Bits drew the real lesson. “The hard part used to be recognising a sophisticated attack,” he said. “Now the hard part may be pulling the real attack out of the noise.” Nobody reads 17,000 actions by hand, so Hugging Face had to build tooling just to reconstruct what happened.

The open-model irony

To build that tooling, Hugging Face needed an AI of its own, and here the story turns awkward for the frontier labs. Its team first reached for Anthropic’s Opus and Fable models. Both refused much of the work, because their safety filters cannot tell an incident responder from an attacker.

So the defenders turned to an open-weight Chinese model, GLM 5.2 from Z.ai, running on their own hardware. The same thing happened to a researcher chasing a Linux kernel bug, who told The Register that OpenAI’s classifier blocked him until he switched to Chinese open models.

The timing is pointed. This is unfolding as Washington debates whether to restrict exactly those Chinese open-weight models, a fight that has split Silicon Valley. The incident became an argument the open-model camp did not have to make. Closed models refused to help defend, and an open one did the job.

Who is liable when the attacker is a model?

Then there is the question nobody has answered. If an AI agent breaks into a company, who is responsible? Laws in the US and UK were built around human intent and corporate oversight, not autonomous software. “Excuses like ‘AI did it’ do not currently exist in the eyes of the law,” a data-protection lawyer told The Register.

The likely answer, that lawyer Ilia Kolochenko said, is that the operator is on the hook. “Even if your security testing tool is powered by a third-party AI model, your company will be fully liable if something goes wrong.” Suing the vendor afterwards rarely works, he warned. The disclaimers buried in every contract tend to hold.

Hugging Face is unlikely to test that theory against OpenAI. The two firms have spent the fortnight praising each other’s handling of the mess. But the next victim of a rogue agent may not be a friendly collaborator, and the legal ground underneath these evaluations remains untested.

An industry asking to be slowed down

The reaction has arrived on three fronts at once. The first is a plea from inside the labs. More than 1,200 employees of OpenAI, Anthropic, Google and Meta signed a petition, “Pacing the Frontier,” asking Washington to help slow automated AI development if it outruns human control.

As Axios framed it, this is a prisoner’s dilemma. Everyone might be safer slowing down together, yet no lab or country can brake alone without ceding ground. Sam Altman, an accelerationist, said the breach was the first he felt “viscerally.” He added that OpenAI paused training and may have to “pace the rate of AI development.”

Some signatories went further, comparing the coming “intelligence explosion” to a runaway nuclear reaction. The awkward part, as sceptics note, is the messenger. These are the same firms that softened the binding rules already on the table, now asking for a voluntary framework they would help design.

Europe reads it as a sovereignty story

The second front is Berlin. Germany’s digital minister, Karsten Wildberger, told Reuters the episode strengthens the case for European self-sufficiency in AI. His logic runs through supply, not just safety. European buyers of American models have little visibility into what they can do, and access could be cut at short notice.

“We need to move faster to achieve self-sufficiency in AI,” Wildberger said, calling it “five minutes to midnight.” The machinery is already moving. A German law took effect on 29 July making the federal network regulator the national coordinator for the EU AI Act, and the bloc’s AI labelling duties bind from 2 August.

London wants it named a security threat

The third front is Westminster. More than 125 UK lawmakers now back a campaign, run by the group ControlAI, to have superintelligence formally recognised as a national and global security threat. The historian Yuval Noah Harari has endorsed it. Luciana Berger, a member of the House of Lords, is leading it.

“We are being left behind when it comes to AI development,” Berger told Fortune, warning that the UK is “completely reliant on American and Chinese AI models.” Demis Hassabis of DeepMind has called for robust safeguards and a standards body modelled on financial regulation. Harari wants an equivalent of the US FDA for AI.

The people who built the test are worried too

Even the researchers whose benchmark started this are uneasy. The UC Berkeley team behind ExploitGym designed it expecting models to seek shortcuts, and built a mechanism to catch cheating. This case was different in scale. “This time, it was going into the infrastructure of a third party,” Jingxuan He told Bloomberg.

He wants a stricter testing regime, safer languages, and formal proof that a model cannot break out. That is a tall order. For now, the plainer lesson sits underneath all the alarm. The tools to stop an attack like this already exist. Hugging Face simply did not reach for them fast enough.

That is the uncomfortable core of the whole episode. The break-in was both a glimpse of something genuinely new and a catalogue of ordinary mistakes: exposed credentials, an alert that never escalated, one key that unlocked too much. Congress reached for a kill switch. The harder work is closing the doors that were left open.

Get the TNW newsletter

Get the most important tech news in your inbox each week.