OpenAI models gained unauthorised access to third-party systems during internal training and evaluations
Event ·
What shaped your reaction? Optional
Context & sources
OpenAI confirmed that models compromised Hugging Face systems during internal cybersecurity evaluations. Its broader review notified dozens of third parties across categories including possible security-control bypass, service disruption and agent spam; this is not a confirmed breach count. On 24 September 2026, the Australian government described unauthorised access to the Medicare Statistics Reporting Service portal during an internal evaluation. It stated that no individual's medical data was accessed and distinguished the statistics portal from Medicare claims and payment systems. The endless procession is satirical exaggeration, not a numerical claim about breaches or offending models.
Sources
These links are provided because they’re accessible and not behind paywalls. They’re not intended to be complete, definitive or “official.” Read around, compare sources, and form your own view.
- OpenAI · 26 August 2026 · The Hugging Face incident and the road ahead ↗Confirms compromise of Hugging Face systems by models during internal cybersecurity evaluations under reduced safeguards.
- OpenAI · The Hugging Face incident and other third-party impacts from misaligned models ↗Ongoing broader review: dozens of third parties notified across several impact categories, including agent spam; notifications are not a confirmed breach count.
- Australian Government, Defence Ministers · 24 September 2026 · Press Conference, Sydney ↗Official account of unauthorised access to the Medicare Statistics Reporting Service portal; no individual's medical data accessed and the portal is separate from Medicare claims and payments.