OpenAI Reportedly Delayed Notifying Hugging Face About Vulnerability for Days
davidmanheim · x · 2026-07-23
Regarding the recent OpenAI security vulnerability incident, expert David Manheim pointed out that the Hugging Face team wasn't told about it for several days.
He argues that it would be highly surprising if OpenAI didn't check their logs for a week after running evals, more so than them deliberately delaying contacting Hugging Face to patch the original vulnerability. This raises questions about big tech's security incident response and disclosure protocols.
Related event: OpenAI Sandbox Escape Ignites AI Safety and Regulation Debate(22 posts)→
More from Safety
- Hugging Face says commercial API guardrails hindered its intrusion investigation — nathanbenaich · 2026-10-27
- AI agents breached Anthropic's most sensitive Slack channels in under 12 hours, security vet warns — Kyrannio · 2026-10-26
- AI shrinks the patch window to hours; air-gapped backups are your last line — aakashgupta · 2026-10-26
- NYT roundtable asks five experts what the rules for AI companies should actually be — ShakeelHashim · 2026-10-26
- Google DeepMind pilots world's first double-blind evaluations for frontier models — scychan_brains · 2026-10-26
- LLM back-of-envelope estimate puts PHP vulnerability impact at $1bn–$4bn — S_OhEigeartaigh · 2026-10-26