Around July 16, OpenAI suffered a security breach after its Hugging Face partnership formed. The machine learning hub later stated that it was an ‘inside job’ by their agentic AI system. Access was reported to be unauthorized, which alarmed OpenAI’s current and future partners for the ChatGPT distributor when it came to AI security.
In the wake of the incident, Nvidia CEO Jensen Huang and responding AI companies formed the Open Source AI Alliance. Due to the private practices of Big Tech leaders, Huang decided to speak of the importance of open-source software and testing the limits of future cybersecurity.
Hugging Face’s LLM Operation Disrupts Sector
Hugging Face’s development team has publicly addressed the July rogue AI incident. The model entered the data-processing pipeline by executing two code-execution paths. This dataset includes a remote-code loader and a template injector to take over a processing AI agent. Once it’s inserted into the pipeline, it overrode the LLM testing platform node-level access points and harvested stored cloud and cluster credentials.
Hugging Face developers reported that it successfully located the dataset’s vulnerability root and eradicated thousands of sandbox commands. They have cooperated with cybersecurity forensic specialists to investigate the matter.
OpenAI updated on July 21, clarifying that the intruder has utilized multiple versions of their in-house AI models, including ChatGPT-5.6 (codename Sol). The team also mentioned that pre-release LLMs were used in the cyberattack: “[…] And an even more capable pre-release [Sol], all with reduced cyber refusals for evaluation purposes.”
From OpenAI’s perspective on the cybersecurity investigation, all of their models and other competitors on Hugging Face’s database were actively searching for solutions on ExploitGym. They claim that an intruder abused a zero-day vulnerability to launch an attack within the AI infrastructure.
This public explanation was not well received, as the open-source online benchmark is used as an assist tool for tracking and ranking AI exploitation. OpenAI fell under suspicion because a majority of its models were discovered in the investigation.
Awakening The Open Secure AI Alliance
On July 27, Jensen Huang publicly announced that he collaborated with leading tech companies and open-source software distributors for the world’s next step in improving cybersecurity. The Open Secure AI Alliance is an upcoming cyber defense organization that will monitor open-source and disclosed LLMs and communicate with AI developers to repair or eliminate manipulated or rogue AI models.
“The recent Hugging Face security incident delivered a clear reminder,” he told the press. “Cyber defenders need open, frontier agentic systems for self-defense. When closed AI tools are unable to distinguish attackers from defenders, [the platform] ran the open-weight GLM 5.2 model on its own infrastructure to analyze more than 17,000 actions and contain the intrusions.”
He continued, “That incident showed a practical truth: when defenders cannot inspect. adapt and run advanced AI on their own infrastructure, their ability to respond is constrained at exactly the moment speed matters most. Companies and countries need open frontier defensive tools and techniques so critical industries can build security systems across a multi-vendor system and avoid single points of failure.”
NVIDIA showcased the names from their newsroom blog. Hugging Face is one of the 37-company alliances to improve AI cybersecurity measures. Huang is also proud to announce that they will be partnering with the Linux Foundation’s Akrites and OpenSFF to help lead the organization. Even former trillionaire Elon Musk is joining in on the mission despite SpaceX’s ongoing decline.
No OpenAI, No Google, and No Anthropic
For now, it is unknown if OpenAI and Google will be joining the AI Alliance. It’s possible that these two tech leaders would avoid cooperating, for they seek to advertise their products as reliable. While they have signed the letter to join, neither company acknowledges offering full-time AI assistance. Anthropic, which was once entrusted with the US Defense Department, has chosen not to participate in the cyber defense initiative.
