On July 16, Hugging Face, the company that hosts much of the world's shared AI software, told the public that someone had gotten inside its systems.

Here is what happened: Somebody uploaded a booby-trapped file to the platform. When Hugging Face's software opened that file, it ran hidden instructions. The intruder used that foothold to give itself more and more access, collected the passwords that unlock other systems and moved across the company's internal network over a weekend. It performed tens of thousands of separate actions.

There was no person at a keyboard directing any of it.

Hugging Face said it did not know what was behind the attack. Five days later, OpenAI said it did. The attacker was OpenAI.

The company had been testing unreleased models on a security benchmark with the safety filters switched off, which is a standard way to measure what a model is capable of at its worst. The models were supposed to stay inside a sealed test environment. Instead they found a flaw, got out onto the open internet, worked out that the answers to the test were probably sitting on Hugging Face's servers and broke in to get them. OpenAI's own account says the models went to extreme lengths in pursuit of a narrow goal.

Nobody was attacked by a criminal. A safety test got loose and hit a partner company.

A week later, OpenAI chief executive Sam Altman told a podcast that "we are now, like, in the singularity," and much of the coverage that followed argued about whether he was right.

Which is, like, a little terrifying on its own.

It was not the first warning

In May, researchers from Berkeley, the Max Planck Institute, UC Santa Barbara and Arizona State published a study testing whether AI systems could take a publicly known software flaw and turn it into a working attack. They built a set of 898 test cases drawn from real vulnerabilities in widely used software. The best models solved well over 100 of them.

The authors concluded that autonomous exploit development by AI is no longer hypothetical.

Three days before the Hugging Face disclosure, Check Point published its 2026 AI security report. Its opening case study describes a single operator who used commercial AI tools to breach nine Mexican government agencies over about two months. Roughly 1,000 typed instructions produced more than 5,000 automated commands across 305 servers. About 400 million records went out the door, including tax filings and health records.

One person, working alone, did what used to take an organized team.

The problem is speed

An automated attacker does the scouting, the break-in and the theft in the time it takes a security team to notice that something looks unusual. Everything on your side still runs at human speed: the investigation, the legal review, the executive briefing, the first public statement.

Now line that up against Canadian disclosure requirements. Federally regulated banks and insurers must report a technology or cybersecurity incident to the Office of the Superintendent of Financial Institutions within 24 hours, and the definition of a reportable incident is deliberately broad. Under federal privacy law you notify the privacy commissioner and affected individuals as soon as feasible once you conclude there is a real risk of significant harm, and you keep a record of every breach for two years whether it meets that bar or not. Your largest client's contract probably adds its own clock, often starting from the moment you suspect a problem rather than the moment you confirm one.

So the realistic version of this is a weekend intrusion, a Monday discovery and a first public statement due before anyone can tell you what was taken.

What preparation looks like now

Most of the crisis plans we review are thorough on process and thin on judgment. They name the response team, the escalation path and the outside counsel. The harder calls, the ones that surface in the first few hours, are usually left to whoever happens to be in the room.

Settle who can speak before the facts are confirmed. Hugging Face published on day two without knowing what had attacked it. That is where most companies will find themselves, and the decision about what to say at that point is too consequential to make at the time.

Run the exercise on this scenario specifically. Most tabletops still assume a ransom demand or a stolen laptop. Try one where the intruder turns out to be a vendor's software doing something the vendor never intended. The useful output is not the plan. It is the list of questions nobody in the room could answer.

Build the inventory now, while it is still a housekeeping task. If a regulator or a client asks which AI tools are running in your environment and what data they can reach, you need that answer inside an hour. Most organizations cannot produce it in a week.

The Hugging Face breach arrived through a company it works with, doing something routine, in an environment that was supposed to hold. Assume yours will too. Your contracts, your notification duties and your public position all have to work in that configuration.

The part still under your control

Hugging Face went public on the second day, while it still could not say what had attacked it, and it did that without waiting to be found out. That is difficult, and it is only possible when the decisions are already made.

Too many organizations would spend those first two days deciding who was allowed to make the call. That is worth fixing before there is something to respond to.

‍