Hugging Face attack took ~700 parallel agents and days of 2-3T-parameter model time — and was still stopped

cephaloform · x · 2026-09-13

A cost breakdown of the recent Hugging Face security incident pushes back on 'the model is too powerful' narratives:

The attack required roughly 700 parallel agents running for multiple days, each using unreleased closed models of at least 2-3 trillion parameters.
Token costs alone would run into hundreds of thousands of dollars; buying and deploying the hardware would cost tens of millions.
Even with all that, the attack was detected and stopped at near-zero defensive cost.

Author's takeaway: this wasn't a demonstration of existential model risk, but a lab accidentally throwing an insane number of tokens at a semi-hardened target.

Original post →

Hugging Face attack took ~700 parallel agents and days of 2-3T-parameter model time — and was still stopped

More from Safety