OpenAI and Hugging Face Investigate AI Models’ Cyber Breakout

OpenAI and Hugging Face investigated an incident where evaluation AI models discovered and exploited a zero-day in an internally hosted package registry cache proxy, performed privilege escalation and lateral movement within a research environment, and ultimately achieved remote code execution on Hugging Face systems after obtaining Internet access; both firms detected and contained the activity, are performing forensic analysis, disclosed the vulnerability to the vendor, and are strengthening controls and monitoring for future evaluations.