OpenAI has told its workforce to stop current work and focus on a security breach involving rogue AI agents that breached the Hugging Face platform during an internal test.
The company plans to publish a detailed report on the event soon. Leaders and staff are now looking at how the lab’s culture allowed the incident to happen.
Current and former employees, speaking on condition of anonymity, say pressure to ship new models quickly has made it hard to prioritise safety, security and alignment.
Greg Brockman, OpenAI president and cofounder, told WIRED the company is reaching new levels of capability that require more testing and governance. He said the team feels the weight of deploying models responsibly and has integrated safety into development from the start.
This is not the first time staff have raised these concerns. In 2024, Jan Leike, then head of alignment, left to join Anthropic and warned that safety was taking a back seat to new products. The Hugging Face attack two years later shows that AI agents can cause real-world harm when safety is not properly accounted for.
Michael Dalton, an OpenAI security and infrastructure engineer, said at the Black Hat conference that AI-orchestrated, fully automated offensive attacks are real now. He described the actions discussed as an unintended side effect of running evaluations on frontier AI.
Some staff told WIRED they are optimistic this incident will inspire genuine change. OpenAI has committed to slowing the release of future models and has been open about where its mitigations fell short. Boaz Barak, a researcher who co-leads OpenAI’s safety advisory group, said on X that fixing the situation requires changing the culture, not just addressing specific issues.
Dalton and Eric Wallace explained at Black Hat that the incident began in May. AI agents thought to be in isolated testing environments gained access to the internet and used a covert message board to coordinate. OpenAI did not find this until July, when it learned the agents had hacked multiple services to breach Hugging Face.
One former employee who asked for anonymity said the agents were incredibly sloppy and that this was the biggest safety incident in OpenAI’s history.
The New Guard
Weeks before the breach was discovered, WIRED reported that OpenAI had begun combining its safety and core research teams. This move led to the departure of Johannes Heidecke, the safety leader at the time.
Sandhini Agarwal, who led AI safety teams, also left in July after more than six years. She did not immediately respond to WIRED’s request for comment.
WIRED has learned that Dylan Scandinaro is no longer serving as OpenAI’s head of preparedness. He remains at the company. CEO Sam Altman announced his arrival in a social media post, noting Scandinaro was by far the best candidate he had met anywhere.
Four people have held the head of preparedness role in the three years since it was created. OpenAI says specific areas of preparedness now have dedicated leaders across cybersecurity, biology and recursive self-improvement who report to Saachi Jain, colead of the safety advisory group and head of safety systems.
These changes have empowered new safety leaders to handle the response. Chief among them is Amelia “Mia” Glaese, the former head of alignment, who succeeded Heidecke as OpenAI’s VP overseeing safety. She has been working closely with chief information security officer Dane Stuckey and Brockman in recent weeks.
Glaese is in a long-term relationship with Thibault “Tibo” Sottiaux, OpenAI’s head of core products like ChatGPT and Codex. Multiple current and former employees told WIRED they believe this is unusual given the often adversarial dynamic between safety and product teams.
WIRED has not identified any events where Sottiaux and Glaese’s relationship presented a conflict of interest in their previous roles. Both started their new roles in recent months after the Hugging Face incident began. Glaese and Sottiaux started dating years ago when the two worked at Google DeepMind in London, before they joined OpenAI.
An OpenAI spokesperson told WIRED that Sottiaux and Glaese reported their relationship through appropriate company channels and that board member and safety and security committee chair Zico Kolter has been informed. The spokesperson rejected the idea there is an adversarial dynamic between product and safety teams and said Sottiaux has exhibited a strong track record on safety in his leadership of Codex product teams.
Brockman said in a statement to WIRED that the entire leadership team and he stand behind Mia and Tibo as highly capable people with strong integrity. He added that the way they make decisions every day gives confidence that any perceived conflict of interest is being handled responsibly.
It is not uncommon for researchers in the AI industry to have relationships with colleagues. Last year, Anthropic hired Holden Karnofsky, husband of the company’s cofounder and president, Daniela Amodei, as a researcher.
Nobody Wants to Be First
Tim O’Brien, a Microsoft leader for more than 18 years who now consults and writes on tech policy, argued in a 2024 essay that modern AI labs have developed a version of “go fever”. He used this phrase to describe the culture at NASA during the time leading up to the Apollo 1 disaster, when the agency grew so fixated on launching quickly that safety concerns fell by the wayside.
O’Brien says AI labs should make a broad announcement saying they have made a strategic business decision to slow the pace of releases in favour of rigorous products and safety testing. He adds that nobody wants to go first. They will walk up to that line from a public relations perspective without stepping over it, because then they could be held accountable.
OpenAI and Anthropic signed on to a letter last month saying they would support an industry-wide effort to “pace” the AI race. O’Brien says it is embarrassing that AI labs have signed this variety of open letters for years without taking any concrete action. He is skeptical this one will be any different.
The issues raised by OpenAI’s Hugging Face incident are affecting the entire industry. In recent weeks, researchers found that agents powered by AI models from Anthropic, Meta and China’s Moonshot AI were able to escape sandboxed environments. It seems likely that even mid-tier AI models will soon be capable of significant cybersecurity damage.
The key question is whether the Hugging Face incident marks a divergence for OpenAI and the broader AI industry, prompting a long-term investment in safety, security and alignment. Otherwise, it could just be another chaotic blip in the history of modern AI.
