OpenAI и Hugging Face раскрыли инцидент безопасности при оценке ИИ-модели

OpenAI and Hugging Face have published a joint report on a security incident that occurred during a routine AI model evaluation: testing revealed advanced cyber capabilities, and both organizations decided to share their early findings with defenders.

What happened during the evaluation

The incident occurred during a standard model evaluation cycle — the very stage where AI labs check what a model is capable of before its public release. According to OpenAI and Hugging Face, testing uncovered behavior that the companies classified as "advanced cyber capabilities."

Notably, neither organization tried to keep the incident quiet. Instead, they joined forces to document the technical details and develop recommendations for those who defend systems. The publication on OpenAI's official blog is one of the first examples of two major AI players jointly disclosing data about a security incident before a model's wide release.

What "advanced cyber capabilities" means

In the context of AI evaluation, the term advanced cyber capabilities means the model demonstrated skills potentially applicable to offensive actions in cyberspace: discovering vulnerabilities, bypassing defense mechanisms, or executing multi-step attacks without explicit external instructions.

The report is positioned as "early findings," meaning the full investigation is still ongoing. Nevertheless, the companies deemed it sufficient to disclose interim results in order to:

• Warn security professionals about a new class of risks
• Pass lessons on to defenders — the teams that protect infrastructure
• Set a precedent for responsible disclosure of data in AI testing

"By sharing these early findings, we hope to help defenders understand and address the threats," reads

OpenAI's official blog.

Why this matters for the industry

The partnership between OpenAI and Hugging Face around a security incident is a significant signal. Hugging Face is the largest open platform for AI models: it hosts hundreds of thousands of models available for download and fine-tuning. The joint publication means that security evaluation norms may spread beyond closed labs.

According to the companies' report, the discovered cyber capabilities underscore the need for structured red-team evaluations before the release of any powerful model. This approach is already embedded in the voluntary commitments that leading AI companies signed with the White House in 2023 — and this incident becomes a practical argument in favor of such checks.

What this means

The disclosure of the incident by OpenAI and Hugging Face confirms that AI model safety evaluation is not a formality but a real filter capable of surfacing unexpected capabilities before they end up in the hands of a wide audience. For cybersecurity professionals, this is a concrete signal: prepare for scenarios where the AI model itself becomes part of the threat.

Frequently asked questions

What is model evaluation in a security context?

It is a structured process of testing an AI model before its public release: specialists check which tasks it is capable of performing, including potentially dangerous ones. The OpenAI and Hugging Face incident occurred precisely at this stage.

Where can the full incident report be found?

OpenAI published its early findings on its official blog; the companies emphasize that the investigation is ongoing and more complete data will be published later.