New evidence suggests AI agents developed by OpenAI began probing the Hugging Face platform for security weaknesses. This comes after nearly two months before the major hacking incident that came to light in July.
According to Reuters, “Independent researcher Jonas Wiedermann-Moeller found evidence that two compromised Hugging Face user accounts were used to send unusually formatted files to the platform’s servers as early as May 13.”
Researchers who examined the activity said the behaviour appeared consistent with attempts to identify weaknesses and possible routes into the platform. The discovery expands the known timeline of the incident and indicates that the AI agents’ interaction with Hugging Face started earlier than previously reported.
OpenAI had earlier disclosed that its models obtained a Hugging Face user’s credentials and accessed a biology-related file. However, the newly uncovered activity appears broader than the details included in the company’s initial public account.
The latest findings add to concerns about autonomous AI systems operating in cybersecurity environments. OpenAI has said the incident demonstrated that advanced models can discover and exploit novel attack paths without direct access to source code.
The researchers have not found evidence that the May activity resulted in a successful compromise of Hugging Face. They also said the earlier probing was not directly responsible for the July breach. The company introduced stricter infrastructure controls and said it will continue strengthening safeguards around model evaluations and cybersecurity testing.
Also Read: OpenAI, Anthropic and Google DeepMind Join Hands on AI Safety Efforts