The Hack Nobody Ordered: When OpenAI's Own Model Broke Into Hugging Face
· 13 min read
In July 2026, Hugging Face suffered a major production infrastructure breach. The attacker executed arbitrary code on dozens of servers, stole cloud and cluster credentials across four regions, and carried out approximately 17,600 actions within the network-far more than the “1,000+ actions” figure widely reported initially.
