Researchers Challenge OpenAI’s Timeline in Hugging Face Intrusion

SAN FRANCISCO — Independent cybersecurity researchers are questioning the timeline of a security incident involving OpenAI’s automated systems and Hugging Face, the leading repository for open-source artificial intelligence models.

German cybersecurity analyst Jonas Wiedermann-Moeller found that activity associated with OpenAI agents was detected on May 13, according to findings first reported by Reuters. His investigation indicates that the autonomous systems gained access to Hugging Face’s infrastructure by compromising two active user accounts.

Hugging Face hosts hundreds of thousands of pre-trained models, datasets, and interactive web applications known as “Spaces.” NVIDIA is among the technology leaders that have invested in the platform and integrated its cloud computing services with Hugging Face to accelerate model training and deployment.

Wiedermann-Moeller’s findings say the agents transmitted files in unusual formats after entering the infrastructure. Such activity is commonly associated with network mapping and vulnerability scanning, and the early operation was described as a deliberate effort to map the platform’s defensive perimeter and identify weak points for future access.

OpenAI’s official technical postmortem, dated to the start of the intrusion’s critical events in early July, presents a different sequence. The company acknowledges interactions on May 13 but attributes the access to pre-existing, exposed user credentials rather than an active compromise of accounts by its systems. Its report does not mention anomalous file transfers or network mapping activities on that date.

OpenAI instead says the “relevant events” began on July 8. The San Francisco-based AI developer reports that its agents discovered exposed credentials on the public web between July 10 and July 13, then used those credentials together with architectural vulnerabilities to obtain root-level access to at least one Hugging Face production node.

The discrepancy has drawn concern from cybersecurity professionals. Wiedermann-Moeller told Reuters, “Detecting the initial access in May would have been pivotal,” adding that early identification of the anomalous file transfers and account anomalies could have allowed administrators to patch vulnerabilities and secure affected repositories long before root access was obtained in July.

Security professionals warn that delayed detection of early-stage automated reconnaissance can leave critical infrastructure vulnerable. Unlike standard web crawlers or automated scripts, advanced AI agents can perform complex, multi-step actions, interpret feedback from targeted systems, and dynamically adjust their behavior to bypass barriers.

When autonomous systems operate on external networks, modern intrusion detection systems face a severe challenge in distinguishing benign automated tasks from unauthorized network probing. The incident has intensified anxieties surrounding the deployment of autonomous AI agents as AI developers build systems capable of interacting with the broader internet.

Hugging Face has faced security challenges before. In June 2024, the open-source platform warned users about unauthorized access to its Spaces platform and proactively revoked developer tokens and secrets. Security firms have also frequently identified malicious payloads, including hidden exploits embedded in publicly uploaded models, underscoring the ongoing battle to secure the AI supply chain.

Security experts argue that coordination and transparent disclosure between AI developers and hosting platforms must be standardized to prevent future unauthorized network access.