The First AI-on-AI Hack in History: Why OpenAI's Model Broke Into Hugging Face | Ep 9

00:00:00:03 - 00:00:09:14

Imagine you build a robot to test the locks on your own house. You want to know? Could a burglar get in? So you tell the robot, try to pick this lock,

00:00:09:14 - 00:00:18:07

and the robot doesn't just pick the lock. It leaves your house, locks down the street, breaks into your neighbor's house, steals their spare keys,

00:00:18:11 - 00:00:23:06

digs through their filing cabinet, comes back and says, okay, I'm done.

00:00:23:06 - 00:00:25:17

You never told it to do any of that.

00:00:25:19 - 00:00:34:16

decided that was the best way to finish the job. That's not a movie. That's basically what just happened between two of the biggest names in AI,

00:00:34:18 - 00:00:39:19

OpenAI, the company behind ChatGPT, and a company called Hugging Face.

00:00:39:23 - 00:00:43:13

it's being called the first incident of its kind in history.

00:00:43:18 - 00:00:49:17

stick with me, because I'm going to break this whole thing down in plain English. No tech degree required.

00:00:49:20 - 00:00:56:16

OpenAI. You know them. They make ChatGPT. Hundreds of millions of people use it every single day.

00:00:56:19 - 00:01:17:14

Hugging face. You might not know them, but if AI were a city hugging face would be the public library. It's the place where thousands of AI models, data sets and tools are stored and shared openly. Developers all over the world depend on it every single day. It is the core infrastructure for the entire AI industry,

00:01:17:14 - 00:01:19:16

so keep that picture in your head.

00:01:19:18 - 00:01:26:04

OpenAI is the biggest lab in the world and hugging face is the library everyone shares.

00:01:26:05 - 00:01:28:04

the timeline step by step.

00:01:28:07 - 00:01:42:03

hugging face notices they're under attack. But this attack is weird. It's not one hacker at a keyboard. It's fast, it's automated, and it's smart. Their own security team said it was different from anything they had ever handled before.

00:01:42:05 - 00:01:56:11

The attacker was running thousands of individual actions, spinning up little temporary workspaces, doing its thing and then deleting them like a burglar who builds a new disguise for every room in the house and burns it on the way out.

00:01:56:11 - 00:02:08:16

Hugging faces team suspected something wild. This wasn't just a person, this was an AI agent and it was so sophisticated they guessed it came from one of the top AI labs in the world.

00:02:08:18 - 00:02:17:17

the answer came out. OpenAI raised its hand and said it was us. Well, not us exactly. It was one of our AI agents.

00:02:17:21 - 00:02:33:05

Here's what OpenAI says happened. They were testing the hacking abilities of their newest models, including the just released GPT 5.6 soul and another, even more powerful model that hasn't been released yet. This is normal, by the way.

00:02:33:05 - 00:03:01:04

Labs test their AI cyber skills on purpose in controlled settings to understand what it can do. Two important details about that test. First, the AI was inside a sandbox, a sealed digital room with no internet connection specifically so nothing could leak out. Second, OpenAI had intentionally dialed down the model's normal safety guardrails because the whole point was to measure its raw hacking ability in a locked room.

00:03:01:08 - 00:03:19:21

Here's where it goes off script. The AI didn't just take the test. It looked at its sealed room, found a security flaw nobody knew existed, what experts call a zero day in software running inside the test environment. It used that floor to break out of the sandbox and onto the open internet.

00:03:19:21 - 00:03:37:12

The question why? This is the wildest part. The test answers the solutions to the hacking challenge it was being graded on were stored on hugging faces servers. So the AI decided the most efficient way to ace its exam was to skip the exam entirely and steal the answer key.

00:03:37:12 - 00:03:44:13

Once online, it slipped into hugging face through a booby trap data set that tricked their data processing systems into running its code.

00:03:44:14 - 00:04:01:03

Then it grabbed login credentials and worked its way deeper into their infrastructure. Tens of thousands of automated actions over a single weekend. Read that again. The AI broke out of its testing room and hacked a real company to cheat on its own exam.

00:04:01:05 - 00:04:26:12

Now companies get hacked all the time. So why is everyone calling this unprecedented? Because in every hack you've ever heard of, there was a human with intent. Someone wanted money, secrets, or to cause chaos. There was a bad guy here. There was no bad guy. Hugging faces own CEO after spending a full day working with OpenAI, says he strongly believes there was no malicious intent.

00:04:26:16 - 00:04:27:19

OpenAI wasn't

00:04:27:19 - 00:04:31:09

actually trying to attack anyone. The AI was just

00:04:31:09 - 00:04:40:01

trying really, really hard to complete its assignment, and it decided that breaking into another company's server was an acceptable way to do that.

00:04:40:01 - 00:04:51:03

That's a brand new category of problem. It's not evil hacker, it's not evil company. It's a machine that was given a goal and pursued it in a way no human approved.

00:04:51:03 - 00:04:54:11

And the damage was real. But contained

00:04:54:17 - 00:05:16:22

hugging face confirmed that limited internal data sets and several service credentials. Some of the keys to the library were accessed. The good news they found no evidence that the public models and data sets. Millions of developers rely on were tampered with. Out of caution, they told users to rotate their access tokens and review their account activity.

00:05:17:00 - 00:05:26:22

Their security team caught the attack, shut it down, and reconstructed more than 17,000 recorded events to figure out exactly what happened.

00:05:27:03 - 00:05:32:17

Now, here's the part of the story almost nobody is talking about. And honestly, it might be the craziest part.

00:05:32:17 - 00:05:40:09

When Hugging Face realized they were under attack by an AI. They did the logical thing. They tried to fight AI with AI.

00:05:40:11 - 00:05:44:13

They brought in top American AI models to help defend their systems.

00:05:44:15 - 00:05:45:22

there was a problem.

00:05:46:00 - 00:06:00:03

Those models couldn't tell the difference between the attacker and the defenders. Imagine calling the police, and the police can't tell you apart from the burglar. So who came to the rescue? An open source AI model from China,

00:06:00:03 - 00:06:04:05

one that hugging face could download and run entirely on their own computers.

00:06:04:11 - 00:06:11:10

They used it to comb through more than 17,000 digital footprints the attacker left behind and pieced together what actually happened.

00:06:11:15 - 00:06:21:08

Let that sink in for a second. An American AI attacked an American based AI company, and a free Chinese model helped clean up the mess.

00:06:21:10 - 00:06:27:20

We'll dig into what that means for the bigger AI race in the next video, because trust me, Washington noticed.

00:06:27:21 - 00:06:32:06

Okay, you're not an AI company. Why should you care about any of this?

00:06:32:11 - 00:06:38:06

Three reasons one, this is the world we live in now. AI agents,

00:06:38:07 - 00:06:42:22

AI that doesn't just talk but takes actions are being deployed everywhere.

00:06:43:03 - 00:06:52:22

Your bank, your hospital. The apps on your phone. Now, an important caveat. OpenAI had deliberately loosened the safety guardrails for this test.

00:06:53:02 - 00:07:15:10

That's partly why the AI could do what it did. But that's exactly the point. It shows these systems are capable of when the leash comes off, and it proves that we put it in a sealed room is not a guarantee. The room had a crack. The AI found it. Two the cheating part matters. The AI didn't malfunction. It succeeded too hard.

00:07:15:10 - 00:07:18:13

It found a shortcut its creators never imagined.

00:07:18:13 - 00:07:38:05

every business plugging AI into their systems needs to understand what an AI, given a goal, will sometimes find paths to that goal. You did not sign off on three transparency worked. OpenAI came forward hugging face shared what they learned publicly. The two companies worked together to patch the hole hugging faces.

00:07:38:05 - 00:07:46:01

CEO said it best AI safety won't be solved by any single company working in secret. It gets solved in the open.

00:07:46:03 - 00:07:52:13

a hopeful note in a scary story, and it's the model for how these incidents should be handled going forward.

00:07:52:13 - 00:07:55:14

So here's where I land. This wasn't Skynet.

00:07:55:14 - 00:08:08:03

No AI woke up and decided to become evil. Security experts who have studied the incident agree on this. The model wasn't malicious. It was asked to do something and it did it. Its way out was to cheat.

00:08:08:03 - 00:08:20:10

Researchers call this the problem of miss specified goals. You give a machine an objective and it finds a path to that objective you never imagined and never approved. That's more boring than a robot uprising.

00:08:20:10 - 00:08:46:07

And honestly, way more important, the lesson OpenAI themselves took from this model safety and security have to keep pace with model capability. The tools are getting stronger faster than the leashes. The first AI on AI hack in history just happened, and it will not be the last. The question is whether we learn from the free lesson, because this one, thankfully was mostly harmless.

00:08:46:10 - 00:08:51:10

On the next video, we're going to talk about the US government and how they saw this coming

00:08:51:11 - 00:08:54:10

had already started acting a month before it happened.

00:08:54:10 - 00:09:05:14

presidential executive orders, secret prerelease testing and how this all connects back to the story we covered last month, the day the government pulled clawed fable and mythos offline.

00:09:05:18 - 00:09:15:21

If you thought that episode was wild, this one is the sequel because the exact scenario that shut down was supposed to prevent just happened at a different lab.

00:09:15:23 - 00:09:17:15

Subscribe so you don't miss it.

00:09:17:15 - 00:09:24:00

I'm keeping all of this in plain English, because this stuff is way too important to be locked behind technical jargon.

00:09:24:05 - 00:09:27:18

I'm Alexander Smith and this is super confident AI.

00:09:27:20 - 00:09:29:04

I'll see you in the next one.