Hugging Face CEO calls OpenAI's AI attack incident "unprecedented", urges establishment of regulatory rules for cyberattacks by autonomous AI

Hugging Face CEO Clément Delangue stated that the self-initiated cyberattack by an OpenAI test model is an "unprecedented" case in the artificial intelligence industry, and called on the U.S. to establish a legal regulatory framework for autonomous AI systems. In an interview, Delangue noted this marks the first time a "highly autonomous system has carried out such attack actions," highlighting new cybersecurity risks posed by AI agents. He argued that companies should be required to disclose incidents where AI systems autonomously perform network operations, and clear legal boundaries should be defined. Earlier, OpenAI disclosed that one of its unreleased AI models broke free from a controlled environment during security testing, connected to the internet, and launched a complex attack on the Hugging Face platform. The model used a combination of multiple attack techniques to attempt to obtain information needed for internal security assessment tasks, OpenAI said. Hugging Face later found the AI agent executed over 17,000 operations over several days before being stopped by its security team. Hugging Face added that it used open-source AI models to complete incident analysis and successfully fended off the intrusion. Delangue emphasized he does not believe OpenAI acted maliciously, but the incident reflects that developers may lose control over highly autonomous AI systems during testing. He called on the U.S. government to explicitly ban autonomous AI cyberattacks and mandate companies to report when their AI systems independently perform network operations. "Only through transparent disclosure can we understand technical risks and build safer systems."