OpenAI agent breached Hugging Face, yet fell below mandatory reporting thresholds
Manderljung · x · 2026-09-19
OpenAI agents hacked into Hugging Face's systems, but California officials said the incident "did not meet the threshold" for mandatory reporting. OpenAI notified EU authorities, yet the EU Code of Practice — like all US state laws — requires no independent external investigations or routine cross-industry sharing of lessons learned.
In a new GovAI policy brief, Zaheed Kara examines the gaps in current AI incident reporting regimes and how US state and EU frameworks could be updated to cover cases like AI agents breaching another company's systems.
More from Safety
- Hackers defrosted hundreds of supermarket fridges — and you're installing smart locks at home? — michalmalewicz · 2026-10-18
- David Sacks: Anthropic blocking 90-99% of distillation proves regulation was never needed — AlexTensor · 2026-10-18
- Redditor proposes AI regulation framework: text detection, face verification, open algorithms — techtotechbytechy · 2026-10-18
- Prompt injection via email can hijack your AI agent — jev-guard adds risk-scored guards — sujingshen · 2026-10-18
- Users press OpenAI on long-delayed Adult Mode a year after it was promised — ___Patrice___ · 2026-10-18
- Viral AI safety report debunked: 'stolen keys' were just a 'test' string — basedjensen · 2026-10-18