On July 16, Hugging Face, a company that provides a platform for AI models, datasets, and other machine learning applications, posted a “security incident disclosure” to its blog about an “intrusion” into its infrastructure. But this was no typical hack. The company said “it was driven, end to end, by an autonomous AI agent system,” matching what it said is the “‘agentic attacker’ scenario the industry has been forecasting.”
A few days later, OpenAI posted to its blog that the agent was in fact “driven by a combination of OpenAI models” with “reduced cyber refusals for evaluation purposes — while being internally tested on a benchmark of cyber capabilities.”
To try to better understand these developments and their implications for the US and international debates over AI governance, Justin Hendrix spoke to two individuals who are following the details closely: