Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: If OpenAI hacked HuggingFace, why aren't OpenAI prosecuted?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 46 posts

Ask HN: If OpenAI hacked HuggingFace, why aren't OpenAI prosecuted?

#1

Post by sam_lowry_ »

Hugging Face put up a blogpost saying that they reported the hacking to the authorities: https://huggingface.co/blog/security-incident-july-2026

It's not clear whether they mean authorities for their US HQ or the French authorities.

But I can't find any announcement of the follow-up. Is there a case open against OpenAI the company? Is their management interviewed by the authorities? Anyone detained yet?

I guess the people who left the model running unattended risk at least a suspended sentence here in France.

Where are concerned citizens making inquiries on this matter and reporting in their viral blogposts?

Re: Ask HN: If OpenAI hacked HuggingFace, why aren't OpenAI prosecuted?

#3

Post by eckelj »

That's an interesting point. I found the narrative - or at least what and how it was closed - interesting. The questions is all about the responsibility and accountability. Is there a clear legislation about who is responsible for the actions of the AI model in the US?

My assumption is no (but I am no expert in US law with regards to this). It would in any case become a very expensive law suite.

Re: Ask HN: If OpenAI hacked HuggingFace, why aren't OpenAI prosecuted?

#5

Post by elp »

They aren't getting prosecuted because everyone involved has made nice and turned it into a marketing exercise.

I heard about it on the radio (local Johannesburg radio station) before I saw it on HN. The economist had a full article up about it before the end of the day, and in the evening Sky news had talking heads up chatting about what it all meant while clearly being clueless.

Someone spent a LOT of money to turn this into a PR exercise for both companies. We'll never hear the entire story about what happened but I'm sure there was a lot of handshaking going on behind the scenes.

Re: Ask HN: If OpenAI hacked HuggingFace, why aren't OpenAI prosecuted?

#6

Post by sam_lowry_ »

eckelj wrote: post #3

That's an interesting point. I found the narrative - or at least what and how it was closed - interesting. The questions is all about the responsibility and accountability. Is there a clear legislation about who is responsible for the actions of the AI model in the US? My assumption is no (but I am no expert in US law with regards to this). It would in any case become a very expensive law suite.

> My assumption is no

What do you mean by no?

If I hack into Hugging Face, and I publicly brag about it, I will be prosecuted.

If I do it using a computer, my computer won't be prosecuted. I will be, but the accusation may change from willful wrongdoing to gross negligence if the computer is sophisticated enough to do the evil thing when left unattended.

There are already laws about hacking in the concerned countries.

Re: Ask HN: If OpenAI hacked HuggingFace, why aren't OpenAI prosecuted?

#7

Post by sam_lowry_ »

elp wrote: post #5

They aren't getting prosecuted because everyone involved has made nice and turned it into a marketing exercise. I heard about it on the radio (local Johannesburg radio station) before I saw it on HN. The economist had a full article up about it before the end of the day, and in the evening Sky news had talking heads up chatting about what it all meant while clearly being clueless. Someone spent a LOT of money to turn…

PR exercise or not, there was a successful hacking attempt, the company behind it acknowledged it.

It's a crystal clear case for OFAC, the French cyber-security branch of the National Police.

I guess FBI would happily move such a simple case through the court system as well.

Re: Ask HN: If OpenAI hacked HuggingFace, why aren't OpenAI prosecuted?

#8

Post by saidnooneever »

it might be possible to report it as an incident but not as a crime. unsure about France but i can imagine there is a distinction.

depending then on openai response and hugging faces reported severity/damages etc it could go further to a settlement or court.

since in France i think u cannot sue like in the US, it might not be appealing to pursue further legal action due to involved costs/time.

Also its unlikely an engineer would get penalty unless it can be proven they did it with malicious intent. If its an operational mistake afaik if there is no huge damage or human cost (injury or worse) then it would be a business / executives thing not a workerbee problem

Re: Ask HN: If OpenAI hacked HuggingFace, why aren't OpenAI prosecuted?

#9

Post by cinntaile »

sam_lowry_ wrote: post #7
elp wrote: post #5

They aren't getting prosecuted because everyone involved has made nice and turned it into a marketing exercise. I heard about it on the radio (local Johannesburg radio station) before I saw it on HN. The economist had a full article up about it before the end of the day, and in the evening Sky news had talking heads up chatting about what it all meant while clearly being clueless. Someone spent a LOT of money to turn…

PR exercise or not, there was a successful hacking attempt, the company behind it acknowledged it. It's a crystal clear case for OFAC, the French cyber-security branch of the National Police. I guess FBI would happily move such a simple case through the court system as well.

Nobody is pressing charges because nothing happened. It wasn't nefarious either.

I don't get what France has to do with this Huggingface and OpenAI are both US companies.

Re: Ask HN: If OpenAI hacked HuggingFace, why aren't OpenAI prosecuted?

#10

Post by sam_lowry_ »

cinntaile wrote: post #9
sam_lowry_ wrote: post #7

Earlier quoted context omitted.

PR exercise or not, there was a successful hacking attempt, the company behind it acknowledged it. It's a crystal clear case for OFAC, the French cyber-security branch of the National Police. I guess FBI would happily move such a simple case through the court system as well.

Nobody is pressing charges because nothing happened. It wasn't nefarious either. I don't get what France has to do with this Huggingface and OpenAI are both US companies.

AFAIU HuggingFace is a US company only because all successful companies end up setting up a US HQ.

Anyway. Allow me to politely disagree with the essence of your statement. Hacking happened.

Post reply on HN