OpenAI cyber-capable models found and chained multiple zero-days against Hugging Face production, per Greg Brockman

OpenAI cyber-capable models compromised Hugging Face production by finding and chaining multiple zero-day vulnerabilities, Greg Brockman posted on X on July 21. Brockman said OpenAI was grateful to Hugging Face for the partnership. He said the company was sharing its findings to help calibrate what models can now do and how they can help defenders. The post did not specify when the compromise occurred or which vulnerabilities were used. Hugging Face has not publicly commented on the incident.