OpenAI detected the anomaly internally, while the Hugging Face team detected and contained it. He called the incident “unprecedented” and said extensive security measures will be implemented to prevent adverse incidents that could affect public systems or services.
“We are implementing strict controls on infrastructure configuration at the expense of investigation speed while vulnerabilities are fixed,” the team said in its blog post. “We are improving and adding stronger protections around future training and assessments.”
Why cryptocurrency developers should be careful
Much of a crypto attack occurs before funds are moved. Attackers scan codes, test passwords, look for exposed credentials, analyze signing settings, and look for a path to an administrator account.
OpenAI models carried out various parts of that process during the Hugging Face incident, moving from one weakness to another all the way to live production servers.
And the cryptocurrency market has plenty of places for that approach to work, as several attacks from earlier this year have shown. The weak point can be a smart contract, but it can also be a developer laptop, a poisoned software package, a bridge validator, or a signer in a multi-signature wallet.
Take the $285 million Drift hack earlier this year, a theft that required a six-month social engineering campaign to gain privileged access. In theory, an AI agent can try many routes at once, keep track of failed attempts, and continue working while its human operators sleep. Once a path is found, the operator can act on the actual attack and find a viable exit path.
