OpenAI did not notice Hugging Face hack for a week

OpenAI failed to detect a security breach involving leaked production API keys stored in Hugging Face Spaces for approximately one week, according to sources cited by Reuters. The delay allowed attackers to maintain undetected access, raising concerns about monitoring and response practices for third-party integrations.

Hacker News https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/ OpenAI did not notice Hugging Face hack for a week Which summary reads better? Pick one — models revealed after.Both summaries are AI-generated. Attackers held undetected access to leaked production OpenAI keys stored in Hugging Face Spaces for a full week before any revocation or security action occurred. This delay proves that your external LLM providers will not proactively flag or block stolen active credentials, leaving your systems vulnerable to silent data exfiltration and massive API billing spikes. If you deploy agents or models utilizing Hugging Face Spaces, you must immediately rotate your production secrets and enforce hard, low-threshold usage limits on your LLM accounts. OpenAI reportedly failed to detect a security breach involving Hugging Face for approximately one week after it occurred. The delay in identifying the hack has raised concerns about monitoring and response practices related to third-party platform integrations.