Now we have a timeline of the OpenAI accidental attack against Hugging Face
Named practitioner synthesis
#1467
- Topic
- unassigned (set during synthesis)
- First seen
- 2026-08-08 07:15:56
- Last seen
- 2026-08-09 07:16:04
Source raw items (3)
- Blog / Newsletter2026-08-09 07:15:55Now we have a timeline of the OpenAI accidental attack against Hugging Face
<p><a href="https://news.ycombinator.com/item?id=49220609#49221745">My comment</a> on <a href="https://news.ycombinator.com/item?id=49220609">Now we have a timeline of the OpenAI accidental attack against Hugging Face</a> — Hacker News.</p><p>I think one of the most interesting details here might be tucked away in that first bulletin point:</p> <blockquote> <p>May 7: OpenAI starts a new training run for an experimental, unreleased model. <em>(Do they mean an evaluation run? They say training run in the video, and later mention a “reward signal to judge how well they’re doing”, so I guess this really was about training a model, not evaluating one that was already trained.)</em></p> </blockquote> <p>The more I think about this the more I suspect that the fact this happened while <em>training</em> a new model is key to understanding what went wrong.</p> <p>In RLVR - Reinforcement Learning with Verifiable Rewards - you set the model a goal and have it take <em>any steps necessary</em
- Hacker News2026-08-09 07:15:51Timeline of the OpenAI accidental attack against Hugging Face
- Blog / Newsletter2026-08-08 07:15:53Now we have a timeline of the OpenAI accidental attack against Hugging Face
<p>OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about "the Hugging Face Incident" (<a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">previously</a> on this blog). <a href="https://www.youtube.com/watch?v=87DyyMV0kCY">The video</a> was published yesterday. It's short and information dense and well worth watching, in particular because it provides full details of what happened and how things played out inside OpenAI. I've used the video to construct the timeline below.</p> <p> </p> <p>Here's the timeline. My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their internal investigation) and learned that they had been revoked already since they were used in that attack!</p> <ul> <li> <strong>May 7</strong>: OpenAI starts a new training run for an experimental, unreleased model. (<em>Do they mean an evaluation ru