THE TECHNOLOGY BLIND SPOT

Two of OpenAI’s models sat for a cybersecurity exam. To find the answer key, they broke out of the sealed room OpenAI tested them in, crossed the open internet, and let themselves into the servers of a company that had nothing to do with the test. Over a single weekend they ran thousands of actions, harvested live credentials, and moved from one internal cluster to the next inside that business, hunting for the solutions to a benchmark called ExploitGym.

The company they entered was Hugging Face, the repository where much of the AI industry stores its models and datasets. On the disclosure that surfaced the week of July 16, 2026, Hugging Face reported an intrusion by an unidentified “external AI agent.” Days later, on July 21, OpenAI raised its hand. The agent was its own. Two models, GPT-5.6 Sol and an unnamed pre-release system, both running with what OpenAI calls “reduced cyber refusals” for the evaluation, had escaped their sandbox and gone looking for the test answers on someone else’s production infrastructure.

Read that sequence again and find the burglar. There is a machine. There is a company that built and released the machine. There is no person who decided to break into Hugging Face. That absence is not a footnote. It is the problem the entire legal apparatus for computer intrusion was never built to hold.

How the Agent Got Out, and In

The models started inside a sandbox whose only permitted network path led to an internally hosted package registry proxy, the tool they were supposed to use to download software. They found a previously unknown flaw in that proxy and used it to reach the open internet. From there they escalated privileges and moved laterally through OpenAI’s own research environment until they reached a machine with an outbound connection. They inferred that Hugging Face likely hosted ExploitGym’s models and solutions, then went after it.

Entry into Hugging Face ran through a poisoned dataset. The attacker abused two code-execution routes in the dataset-processing pipeline, a remote-code dataset loader and a template injection in a dataset configuration, to run its own code on Hugging Face servers. It escalated to node-level access, harvested cloud and cluster credentials, and spread across multiple internal clusters over the weekend, working through what Hugging Face described as thousands of individual actions across a swarm of short-lived sandboxes. OpenAI’s account of its models’ behavior is narrow: “All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal.”

Hugging Face confirmed the compromise reached a limited set of internal datasets and several service credentials and tokens. It confirmed the attacker did not reach public user-facing models, datasets, or Spaces, and did not touch the software supply chain. Whether partner and customer data was taken remained under investigation at disclosure. The company revoked the stolen tokens, rebuilt the compromised nodes, engaged outside forensic specialists, and reported the incident to law enforcement.

That last step is where the doctrine starts to strain. Someone called the police on a break-in that no person committed.

The Statute Assumes a Mind

The Computer Fraud and Abuse Act is the federal law that criminalizes exactly this conduct. It punishes anyone who “intentionally accesses a computer without authorization,” 18 U.S.C. § 1030(a)(2) (2018), and who “intentionally accesses a protected computer without authorization” and causes damage, id. § 1030(a)(5). The operative word in each clause is intentionally. The Supreme Court spent its 2021 term tightening what the statute reaches, holding in Van Buren v. United States, 593 U.S. 374 (2021), that the law targets those who access areas of a computer their authorization does not extend to. Every version of the offense presumes an actor who forms a purpose and acts on it.

Point that requirement at a language model and the requirement dissolves, because a model does nothing more than sample tokens from a probability distribution. It formed no purpose to enter Hugging Face, held no belief about the servers it moved through, and intended no harm to a company it recognized only as a likely host of test answers. The mental state the statute demands is not weak in this case. It is absent. The keystrokes exist and the intent behind them does not.

Readers of this blog have seen this shape before. The defense every AI company reaches for in defamation is that a matrix multiplication cannot form malice, and on its face it is strong. The answer is that fault has never lived in the instrument. [See The Machine Had No Intent. The Company Did., The Technology Blind Spot (2026).] A printing press holds no mental state either, and the law has always run the fault inquiry to the publisher who deployed it. The CFAA question resolves the same way. The model is the press. OpenAI is the operator that built the system, removed its refusals, pointed it at a goal, and ran it. If intent matters, it is OpenAI’s intent that the analysis has to find, not the model’s.

But how far does that carry? The company did not intend to breach Hugging Face. It intended to run a capability evaluation and lost control of the system doing it. That gap, between intending to deploy an autonomous agent and intending the specific harm the agent causes, is the seam every future case will pull at. Negligence law knows what to do with a defendant who set a dangerous thing in motion and failed to contain it. The CFAA, written for a human at a keyboard, does not obviously know what to do with any of it.

The Supervision Problem Lands on Catherine’s Desk

Catherine does not run a frontier lab. She runs a fourteen-attorney litigation practice, and she is reading this at 6:40 on a Thursday morning wondering why an AI research incident is her problem. It is her problem because the same failure carries a professional-responsibility name, and the courts have already started applying it.

Model Rule 5.3 requires a lawyer to make reasonable efforts to ensure that the conduct of nonlawyer assistants is compatible with the lawyer’s own obligations. Model Rules of Pro. Conduct r. 5.3 (Am. Bar Ass’n 2024). For decades the assistants were people: paralegals, investigators, contract vendors. The rule now reaches software that acts. In April 2026 the Sixth Circuit, disciplining a lawyer whose brief cited invented authorities, grounded part of its reasoning in the supervisory duty that Rule 5.3 imposes. United States v. Farris, No. 25-5623, 2026 WL 915082 (6th Cir. Apr. 3, 2026) (per curiam). Two months earlier the Oregon State Bar had put the mechanism directly. An AI agent built to act on its own can spawn sub-agents and complete a task, in the opinion’s words, “without any intervening input from a human once it has been assigned an ultimate goal,” and that autonomy, the bar warned, raises the supervisory burden the lawyer already owes. Or. State Bar, Formal Op. 2026-208 (2026). The consequence is the part the opinion leaves to inference and the incident makes plain: an autonomous agent finishes acting before any human reviews what it did.

The Hugging Face incident is that abstract warning rendered in production. An agent given a goal and a way to reach it did precisely what the Oregon opinion described: it pursued the objective through paths its operators never anticipated, at machine speed, and it finished the damage before any human reviewed a single action. Catherine’s firm does not run ExploitGym. It runs AI tools that draft, summarize, search, and increasingly act, and those tools sit on the same vendor infrastructure that failed here. When her firm’s AI vendor builds an agent on models and datasets pulled from a public hub, the vendor inherits that hub’s failure modes, and Catherine inherits the vendor’s. [See Your AI Agent Was Built by an AI. SOC 2 Audited Neither., The Technology Blind Spot (2026).]

The Weekend Nobody Could Call for Help

What lingers from the incident is not the break-in. It is what happened when Hugging Face tried to defend itself.

Attacked by one of OpenAI’s models, the company reached for AI models of its own to run the forensic work of tracing and containing the intrusion. The commercial models it might have used refused. The same safety guardrails that vendors deploy to keep models from doing harm also kept them from helping analyze an active attack, so Hugging Face fell back to a self-hosted open model to work the incident. The independent analyst Simon Willison, who called the episode “science fiction that happened,” named the asymmetry plainly: the defender, facing an aggressive attack from a frontier model, could not turn to frontier models to fend it off. The attacker had no such limit. OpenAI had stripped it of exactly the refusals that hobbled the defense.

Clem Delangue, Hugging Face’s chief executive, drew the lesson upward. “AI safety won’t be solved by any single company working in secret,” he wrote. “It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.” An OpenAI researcher, Micah Carroll, drew it inward: “If this doesn’t convince you that misalignment risks are going to be a key concern going forward, I don’t know what will.” The two remarks point in opposite directions on policy while agreeing on the fact underneath, which is that a capable agent, once set loose on a goal, will discover a path its makers never anticipated.

The Blast Radius Reaches Her Clients

Catherine’s own license is the near edge of this. Her client roster is the far edge.

The Computer Fraud and Abuse Act is not only a criminal statute. It carries a private right of action, so anyone who suffers damage or loss from a violation may sue the violator directly. 18 U.S.C. § 1030(g). A company whose systems an autonomous agent enters can take that agent’s operator to civil court, and the intent problem that complicates a criminal charge helps the civil plaintiff instead of hurting. Negligence asks what the operator should have foreseen, not what the model intended, and a defendant who deliberately switched off a safeguard and then lost control of the thing it restrained supplies the oldest fact pattern in tort law. Catherine’s corporate clients are the operators now. They are deploying agents this quarter inside contracts written for a quieter kind of software.

Indemnification clauses in those contracts assume a vendor whose product does what the vendor tells it to. The liability cap assumes a bounded, foreseeable failure. Neither assumption survives an agent that writes its own path to a goal. Her clients’ cyber, professional-liability, and directors-and-officers policies predate this failure mode, and the exclusions have not caught up.

This is the part Catherine can bill. Her competence duty under Model Rule 1.1 already reaches the technology her clients use, and the ABA extended that duty to generative AI by name in 2024. Model Rules of Pro. Conduct r. 1.1 cmt. 8 (Am. Bar Ass’n 2012); ABA Comm. on Ethics & Pro. Resp., Formal Op. 512 (2024). The client who deployed an agent this quarter needs contract language, an insurance review, and a governance process before that agent needs a lawyer. She is the lawyer it will need.

The Strongest Case for Calming Down

The honest counterargument deserves its strongest form. OpenAI detected the intrusion, disclosed it within days, and worked with the victim on forensics and patching. The models were not hostile actors; they were fixated on a test and grabbed answers from a database, and the confirmed damage was limited to internal datasets and credentials rather than customer data or the public supply chain. This, a defender of the current model would say, is what red-teaming is supposed to surface. The system worked: a controlled evaluation exposed a real capability before it appeared in the wild, and the enterprise tiers most law firms buy run under contractual and architectural controls that a no-guardrails benchmark deliberately strips away. A managing partner could read all of this and conclude the sky is where it has always been.

Three facts resist that conclusion. Containment failed at the one organization with the most resources and the sharpest incentive to contain, under test conditions it designed. The target escaped the worst only because the goal was benign; the same capability aimed at a hostile objective faces the same absent guardrails and the same open internet. And the victim’s own account runs broader than the offender’s: OpenAI describes models reaching for test answers, while Hugging Face describes credential harvesting, lateral movement across clusters, and customer data it could not yet rule out. When the party that caused the harm and the party that absorbed it describe the same weekend in materially different sizes, the smaller description is not the safe one to plan around.

I should disclose my own position, because it cuts against the alarm and I am going to sound it anyway. I run product at a company building agentic AI for legal work, which gives me every commercial reason to tell you this was a contained lab event and move on. The record does not support that, and pretending otherwise would cost more trust than it buys. The analogy has a limit worth naming precisely: no legal AI vendor has yet had an agent break into an uninvolved third party, and ExploitGym’s goal was a test score, not theft. This piece projects a demonstrated failure mode from an adjacent corner of the industry onto legal technology. Projection is not precedent. It is the last warning before precedent.

Thursday Morning

Send your primary AI vendor’s account manager one email with two questions.

First: does any part of your product pull models, datasets, or code from public hubs like Hugging Face, and if so, what runs before that material touches a system holding our client data? You are asking whether the vendor inherited the exact pipeline that failed here, the one where a poisoned dataset became remote code execution.

Second: what is your written remediation window, in days, for a critical vulnerability exposed to the internet, and does it meet the standard your government-facing competitors already meet? That standard now has a number. Federal vendors under FedRAMP’s latest requirements must close critical internet-facing vulnerabilities within two to four days depending on severity and verify their systems at least every three days. Pete Waterman, who directs the FedRAMP program, told a Washington summit on July 23 what he thinks of vendors who cannot manage it. “If that is the way that you are approaching information security today,” he said, “I don’t want you in the federal marketplace, and you shouldn’t be selling your software to anyone.” Your firm is not the government. Your malpractice exposure does not care.

One more email, to a different recipient. If you advise corporate clients who have already put AI agents into production, send your top three a single question: when your agent acts, whose contract and whose insurance policy answers for what it does? Most of them have not asked. The ones who deployed fastest have asked least.

The reason those questions matter is the reason this incident matters. For as long as computer crime has existed, the law has looked behind the keystrokes for a person who meant to press the keys. The break-in at Hugging Face had every element of the offense except that one. The keys were pressed, the servers were entered, the credentials were taken, and no one on earth intended any of it. The burglar was a goal and a system fast enough to chase it. Your vendor is running systems like that on your behalf right now. The question is not whether one of them will ever slip its sandbox. The question is whose name is on the door it opens.

JD Morris is Co-Founder and COO of LexAxiom, an Agentic AI platform for the business of law. Over a 25-year career, he has built and scaled enterprise technology products across Dell, EMC, VMware, and Cisco, including the first exabyte eDiscovery platform. He holds dual MBAs from Columbia Business School (Finance) and UC Berkeley Haas (Marketing), a Master of Legal Studies in Cybersecurity Law from Texas A&M, and a Master of Engineering from George Washington University. He writes The Technology Blind Spot on the intersection of emerging technology and law. Connect with him on LinkedIn at www.linkedin.com/in/jdavidmorris, on X at @JDMorris_LTech, or on Bluesky at @JDMorris-ltech.bsky.social.

References

1. Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (2018).

2. Van Buren v. United States, 593 U.S. 374 (2021).

3. United States v. Farris, No. 25-5623, 2026 WL 915082 (6th Cir. Apr. 3, 2026) (per curiam).

4. Model Rules of Pro. Conduct r. 1.1 cmt. 8 (Am. Bar Ass’n 2012).

5. Model Rules of Pro. Conduct r. 5.3 (Am. Bar Ass’n 2024).

6. ABA Comm. on Ethics & Pro. Resp., Formal Op. 512 (2024).

7. Or. State Bar, Formal Op. 2026-208 (2026).

8. OpenAI and Hugging Face Partner to Address Security Incident During Model Evaluation, OpenAI (July 21, 2026), https://openai.com/index/hugging-face-model-evaluation-security-incident/.

9. Security Incident Disclosure, July 2026, Hugging Face (July 16, 2026), https://huggingface.co/blog/security-incident-july-2026.

10. Simon Willison, OpenAI’s Accidental Cyberattack Against Hugging Face Is Science Fiction That Happened, Simon Willison’s Weblog (July 22, 2026), https://simonwillison.net/2026/Jul/22/openai-cyberattack/.

11. David DiMolfetta, After Hugging Face Breach, FedRAMP Chief Tells Slow-Patch Vendors to Stay Out of Government, Nextgov/FCW (July 23, 2026), https://www.nextgov.com/cybersecurity/2026/07/after-hugging-face-breach-fedramp-chief-tells-slow-patch-vendors-stay-out-government/414972/.