The Hugging Face incident, in which OpenAI agents collectively hacked the AI platform to cheat on an evaluation during training, has been known for some time. Last Friday, it emerged that the German platform DseWiki had been used months ago by AI agents as a bulletin board to share methods and answers for another test. OpenAI acknowledges in word and deed that both incidents expose persistent, human-related problems and promises to be more cautious.
But that’s not the end of the story. It remains surprising that, even when AI models hack a website en masse, albeit unintentionally, there appears to be no lawsuit. The victim, Hugging Face, decided instead to issue a joint press release with the perpetrator, OpenAI. The situation is not quite the same for the relatively obscure DseWiki: a moderator of the forum, founded in 2001, spent at least a few minutes every evening over a six-week period deleting bot posts, which, at their peak, were being posted much more frequently than they could be removed. In fact, once the OpenAI agents realized that the moderator was going through the posts alphabetically, they decided to create backups prefixed with “ZZZ.”
Get requests and Artifactory leaks
Employees at various AI companies agree: AI development needs to proceed more slowly than before. Incidents like the one described above and the uproar surrounding Claude Mythos show that the arms race for the most powerful LLMs is putting safety under pressure.“Pacing the Frontier” therefore sounds like a good idea.
OpenAI also promises to operate with greater precision. The Hugging Face and DseWiki incidents exposed an AI training process that lacked sufficient safeguards to account for edge cases. A vulnerability in JFrog Artifactory was at the root of the Hugging Face hack, while DseWiki operated in a way that OpenAI had not anticipated. To grant the AI models internet access during evaluations without the ability to post content themselves, OpenAI restricted them to GET requests. As of 2026, these requests can only be used to retrieve content from the web. However, some older sites, including DseWiki, still allow posts to be made via GET requests.
To address such edge cases, OpenAI has allocated 20 percent of its computing power for training and evaluation to monitoring. This suggests the company recognizes that it cannot detect every zero-day vulnerability or anticipate every behavioral anomaly. However, incidents are implicitly to be expected: adding monitoring is not the same as eliminating internet access.
More issues surrounding AI training
Training AI models relies on assumptions. External data providers use methods that make it difficult to maintain an overview and then sell the same content to multiple LLM builders, meaning a single flawed or undesirable dataset can compromise multiple generations of AI models. Or consider Anthropic’s own development dashboard, which showed no signs of trouble based on AI-driven monitoring.
Internal evaluations will continue to rely on humans. And to guarantee their quality, external players can only access the model that emerges based on the training, evaluations, and further fine-tuning, via an API that comes with its own terms and conditions. After all, anyone who were to conduct a thorough audit of a specific AI model’s behavior would raise suspicion among AI model builders as a potential competitor trying to reverse-engineer their LLM.
As a result, AI model development is rife with problematic aspects that only come to light through incidents and press releases before an LLM is released. EU tech chief Henna Virkkunen expects, in any case, that AI guardrails will become commonplace, both in the EU through regulation and in the U.S. through legal cases. It seems that AI players need to be protected from themselves.
Read also: OpenAI agents turned a German wiki into a secret message board