Hacker News Reader

Comment by throwa356262 | Hacker News Reader

Two things don't add up here:

1. If huggingface has access to uncensored OAI models, how come they had to use GLM 5.2 to investigate the intrusion?

2. Once the model gains network access, can't it cheat to a perfect score by looking at the full dataset? Why go into the trouble of doing this kind of things:

"In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers."

Not saying this is marketing BS (this is after all, not Anthropic) but I feel OAI staff may be exaggerating a bit here.

View on HN

"The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database. [...]
While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem. [...]

After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation."

escaped openai, hacked hugging face to get the solutions. your #2 is exactly what it was trying to do.

Huggingface did not have access to the models. They were running in OAI’s infrastructure.

Ah, that makes more sense :)

But then, why attack huggingface? The exploitgym dataset is on github and can be downloaded without need for exploits?

breadth search and found huggingface first? Pure speculation

I read it as _now_ they have access to the models but not during the intrusion

I think it was the other way around, uncensored OAI models (run by OAI) got themselves (extra) access to HF?

https://huggingface.co/blog/security-incident-july-2026

They explain it here, basically for data security/privacy reasons

Reply on news.ycombinator.com