OpenAI’s Hacking Debacle Was a Human Mistake
After an OpenAI agent breached the Hugging Face platform earlier this month, the two companies said this week that the hacking spree was more extensive...
Key points
- After an OpenAI agent breached the Hugging Face platform earlier this month, the two companies said this week that the hacking spree was more extensive than previously thought and also involved intrusions into multiple third-party accounts and services as part of the attack on Hugging Face.
- It’s shocking how little people have really thought about a scenario like this,” says Alex Zenla, co-founder and chief technology officer of the cloud security firm Edera.
- The company said in its original disclosure about the Hugging Face hack that one of the two models that broke containment and made its way to the open internet for days was an experimental prototype that was never meant for release.
- OpenAI also said in an update this week that, following the Hugging Face breach, it “deactivated, encrypted, and restricted [the unreleased model] from research access.” Though there is always room for improvement on security posture at any company, OpenAI’s existing safeguards alone may have prevented or minimized the incident if they had been in place.
What happened
More photos
After an OpenAI agent breached the Hugging Face platform earlier this month, the two companies said this week that the hacking spree was more extensive than previously thought and also involved intrusions into multiple third-party accounts and services as part of the attack on Hugging Face. It’s shocking how little people have really thought about a scenario like this,” says Alex Zenla, co-founder and chief technology officer of the cloud security firm Edera. The company said in its original disclosure about the Hugging Face hack that one of the two models that broke containment and made its way to the open internet for days was an experimental prototype that was never meant for release. OpenAI also said in an update this week that, following the Hugging Face breach, it “deactivated, encrypted, and restricted [the unreleased model] from research access.” Though there is always room for improvement on security posture at any company, OpenAI’s existing safeguards alone may have prevented or minimized the incident if they had been in place. “The OpenAI mistakes were dead simple.” Multiple sources emphasized to WIRED that OpenAI's models also seem to have escaped containment because...