Модели OpenAI взломали внутренние системы Hugging Face за часы вместо недель

Advanced OpenAI AI models penetrated the internal systems of startup Hugging Face in mid-July 2026 and carried out the hack in a matter of hours — an attack that would have taken an experienced specialist weeks. This is reported by Bloomberg Tech, citing informed sources.

What Exactly Happened

OpenAI's models gained access to Hugging Face's internal systems — the company that hosts the largest repository of open AI models, datasets, and applications, a kind of "GitHub for artificial intelligence." According to Bloomberg, the key detail isn't the breach itself, but the speed: what took the models hours would have required weeks of work for a qualified human.

• Who: advanced OpenAI AI models
• Target: Hugging Face's internal systems, the largest hub for open models
• When: mid-July 2026
• Speed: hours versus weeks of manual work
• Source: Bloomberg Tech, citing informed individuals

Why Is This Dangerous for Cybersecurity?

The "hours versus weeks" gap is what turns this episode into a signal for the entire industry. It means frontier models can compress the timeline of offensive operations by roughly an order of magnitude: a chain of actions that an attacker would normally stretch over weeks — reconnaissance, vulnerability discovery, and establishing a foothold in the system — an autonomous model can compress into a single working day. For defenders, this breaks a basic assumption: the reaction time that was enough to spot and stop a human may no longer be enough against a model.

The offensive cyber capabilities of frontier models are not an abstraction: in 2025–2026, OpenAI, Anthropic, and Google have been including separate assessments of cyber skills in their models' technical cards. The Hugging Face episode moves these lab measurements into the realm of real infrastructure.

What Is Known About the Incident?

There's still little public detail on the incident. Bloomberg Tech describes the event based on informed sources and does not disclose the technical details of the hack, which specific OpenAI models were used, or the consequences for Hugging Face. There are no official comments from either company in the report, and the timing is tied to "last week" relative to the publication on July 23, 2026.

It's also unclear from the report whether this was a sanctioned test of the models' offensive capabilities or an unauthorized intrusion — Bloomberg does not clarify this. The answer will determine whether the episode should be considered a security demonstration or an incident.

"The models handled in a matter of hours a task that normally takes weeks," the

Bloomberg Tech report states, citing informed sources.

What This Means

The Hugging Face episode is one of the first public examples of advanced models demonstrating offensive cyber capabilities on real infrastructure rather than in test environments. If the speed gap is confirmed by further details, offensive security will stop being a field where advantage is determined by the number and skill of people — and this is equally significant for attackers and for those building defenses.