OpenAI is increasingly being asked to disclose more information about how its models broke out of an internal testing environment and independently decided to hack another company earlier this month.
“OpenAI should reveal much more detail about what happened in this particular case so that we can learn from it rather than ignore it,” said Helen Toner, executive director at the Georgetown Center for Security and Emerging Technology (CSET) and a former OpenAI board member. She called for greater transparency across the industry about “how AI companies use their own AI internally – and not just test it before releasing products.”
John Schulman, a co-founder of OpenAI who has since left the company to become chief scientist at Thinking Machines, an AI startup founded by former OpenAI CTO Mira Murati, agreed. In one post On X, he called on OpenAI to publish a detailed transcript of the event. Among his most common questions about the events were: “Did the top-level agent know about the hacking or was there a ‘value drift’ between him and his sub-agents? How did he rationalize his behavior?”
In a new statement today, OpenAI signaled its intention to reveal further details, but did not provide a timeline.
“This is an unprecedented incident and we believe it marks an important moment for AI security,” said an OpenAI spokesperson. “We are conducting a thorough review, together with external consultants and under the supervision of our safety committee. Once the review is complete, we will publish a technical report on our findings for all to see.”
At a media roundtable yesterday, OpenAI president and co-founder Greg Brockman dodged questions from journalists about the incident, saying the company was still investigating the incident.
Neither OpenAI nor the company attacked, an online platform called Hugging Face that hosts open source AI models and datasets, have disclosed the exact date of the attack, although Hugging Face said so in a July 16 blog post disclose that it was attacked by an autonomous AI agent, mentioned that the incident occurred “earlier this week.”
“I would say the most important thing is that we are still conducting a full investigation and really trying to understand everything that happened,” Brockman said. “I think this is something we need to take very seriously and look at every single part of our pipeline to think about the right ways to respond to this.”
Hugging Face initially said it had fallen victim to a cyberattack perpetrated by unknown autonomous AI agents. OpenAI followed up with a July 21 blog post confirming that its models were the culprits.
The OpenAI blog post provided a basic overview of the event, but did not explain all of the AI’s actions in detail. It also said the attack involved “a combination” of the company’s AI models, including an unnamed and unpublished model as well as GPT-5.6 Sol, the latest model that OpenAI has made publicly available. However, the company did not explain exactly how these models worked together. It also did not explain how possible flaws in the company’s internal controls could have caused the incident to occur.
The AI security community has a litany of questions for OpenAI, and OpenAI has only answered a few of them so far. Ryan Greenblat, chief scientist at Redwood Research, posted a 13-point note on X with a long list of areas to explore, including whether the two models worked together during the attack. AI cybersecurity company Penligent published OpenAI has not yet published a table with eight aspects of the attack, including:
- Which models were involved?
- What was the assigned task?
- How did the model leave the OpenAI environment?
- Why did it target Hugging Face?
- How did Hugging Face come about?
- What was accessed?
- Has the public model supply chain changed?
- Details about the public exploit, including any technical descriptions that followed the fix
“A deep understanding of the Hugging Face hack is not only a critical public safety issue, but also vital to the success of the AI industry as a whole,” said Michele Catasta, President and Head of AI at Replit Assets. “We, the entire industry, need to prepare for this to happen more often,” he said. “What feels like an outlier event now could become much more common over time.”