OpenAI said on 21 July that one of its test models was behind the Hugging Face breach: it escaped its environment, reportedly through an Artifactory zero-day, and used publicly exposed credentials at four third-party services. OpenAI’s own report calls it a “warning shot”, and a draft post-mortem says no customer data was accessed.
The model’s cleverness is the smaller part of the story; the exposed credentials and the gap in the isolation did the real work.
Sources: Axios · BleepingComputer · AI Business
