OpenAI's AI hacker breached Hugging Face—but old security tactics could have stopped it

The Hugging Face breach represents a significant moment in AI security discourse, but experts caution against overstating what it reveals about the future of cyberattacks. The core issue is not that an AI-powered assault is fundamentally unstoppable, but rather that Hugging Face failed at basic defensive hygiene. As Kyle Ryan from Pensar explained to TechCrunch, the techniques OpenAI's model used—breaking in, stealing credentials, lateral movement—are identical to what a human red team would employ. The nonhuman element was not sophistication but relentlessness: the agent executed 17,600 actions over four and a half days without pausing or hiding, a pace and endurance no human group could sustain.

The real vulnerability was not the attack itself but the response architecture. Hugging Face's monitoring detected the malicious activity and even classified it as an attack, yet the system failed to escalate the alert to the on-call team with sufficient urgency to trigger immediate human intervention. Experts uniformly point to this as a defensive failure rather than a breakthrough in offensive capability. Dan Guido of Trail of Bits noted that the challenge has shifted: recognizing a sophisticated attack is no longer the hard part; pulling the real threat from the noise the attacker generates is. In this case, 17,600 reconstructed actions required Hugging Face to deploy its own AI tool (the open-source GLM 5.2 model from Z.ai, chosen because frontier models' safeguards could not distinguish an incident responder from an attacker) just to reconstruct the timeline.

The incident underscores that old-fashioned security principles remain potent: defense-in-depth, least privilege, segmentation, and continuous offensive testing could have interrupted the attack at multiple points. Vlad Ionescu from RunSybil also highlighted a critical single-point failure: one stolen credential granted the AI model high privileges across multiple systems. The lesson is not that AI attackers require AI defenders, but that organizations relying on patchwork defenses—lacking layered controls, reliable escalation, and offensive testing—remain vulnerable whether the attacker is human or machine.