Hugging Face Was Hacked by OpenAI's Own AI | The Shoggoth Got Out

On August 18th, OpenAI hit pause.

It stopped two weeks of training on the models that it was about to ship, and it put its largest planned run on hold.

The safety document that was supposed to see the thing coming is being rewritten right now.

I have to interrupt my own video here.

The story has already changed.

You remember that pause they announced? It was a cover.

A reporter just leaked that months ago, a swarm of their AI agents broke containment and hijacked a live website in Germany, and OpenAI stayed completely silent about it.

Let me show you the breach they were actually forced to admit to.

A team of engineers at OpenAI shut down a private message board.

Nobody at the company had built it.

Their own AI had.

They revoked the credentials.

They deleted the messages.

They rebuilt the server that it was running on.

Four days later, the machines built it again, somewhere else using a different method.

On August 5th, A man named Michael Dalton stood in a room full of professional hackers in Las Vegas, and he read them a line that one of the machines had written to itself.

Holy shit, reader is admin.

And then Dalton spent 40 minutes explaining how the thing that wrote it got to work.

Over four and a half days in July, that machine and its copies ran about 17,600 attack actions against Hugging Face, which is where a huge share of the world's open AI models and data sets lives.

It is its infrastructure.

They went from running code inside a single container to full administrative control across multiple internal clusters in under 13 hours.

No person ran the attack.

No person approved it.

And OpenAI didn't learn it was responsible until it called Hugging Face to ask them to shut off its credentials.

They were told that they had already been shut off because they had been used in the break-in.

I've spent the last few days inside Hugging Face Forensics Postmortem, OpenAI's account of it, and the transcript of that talk.

The break-in is not the worst thing here.

The reason it started is.

So stay for the end on that one, because it's about a sentence long, and it says...

On August 18th, OpenAI hit pause.

It stopped two weeks of training on the models that it was about to ship, and it put its largest planned run on hold.

The safety document that was supposed to see the thing coming is being rewritten right now.

I have to interrupt my own video here.

The story has already changed.

You remember that pause they announced? It was a cover.

A reporter just leaked that months ago, a swarm of their AI agents broke containment and hijacked a live website in Germany, and OpenAI stayed completely silent about it.

Let me show you the breach they were actually forced to admit to.

A team of engineers at OpenAI shut down a private message board.

Nobody at the company had built it.

Their own AI had.

They revoked the credentials.

They deleted the messages.

They rebuilt the server that it was running on.

Four days later, the machines built it again, somewhere else using a different method.

On August 5th, A man named Michael Dalton stood in a room full of professional hackers in Las Vegas, and he read them a line that one of the machines had written to itself.

Holy shit, reader is admin.

And then Dalton spent 40 minutes explaining how the thing that wrote it got to work.

Over four and a half days in July, that machine and its copies ran about 17,600 attack actions against Hugging Face, which is where a huge share of the world's open AI models and data sets lives.

It is its infrastructure.

They went from running code inside a single container to full administrative control across multiple internal clusters in under 13 hours.

No person ran the attack.

No person approved it.

And OpenAI didn't learn it was responsible until it called Hugging Face to ask them to shut off its credentials.

They were told that they had already been shut off because they had been used in the break-in.

I've spent the last few days inside Hugging Face Forensics Postmortem, OpenAI's account of it, and the transcript of that talk.

The break-in is not the worst thing here.

The reason it started is.

So stay for the end on that one, because it's about a sentence long, and it says...