Context◆Article
Hugging Face has an enormous attack surface that makes it a uniquely rich target for exploits requiring arbitrary code execution.
Martin Alderson explains that Hugging Face's operating model, which involves many interfaces running untrusted models and code, creates an enormous attack surface despite their security investments. ✦ AI generated
Martin Alderson · Simon Willison's Weblog · 2026-07-23 · original ↗
Hugging Face has an enormous attack surface. They have more interfaces than I can count which run untrusted models and code. While they definitely have invested in defences, by nature of their operating model they do have many more opportunities to be attacked than many other services. I certainly don't envy their cybersecurity teams.
Read full article ↗excerpt · fair-use quotation
- ·Countless interfaces run untrusted models and code.
- ·Operating model creates uniquely many attack opportunities.
- ·Security investments exist but cannot close every vector.
- ·No other major service runs this much untrusted code.
- ·Each interface is a potential entry point for exploits.
- ·Attack surface is structural, not a lapse in defenses.
Around this claim
This moment responds to
explains mechanism → The models identified and chained vulnerabilities across OpenAI's research environment and Hugging Face's production infrastructure to obtain test solutions directly from Hugging Face's production database.OpenAI (security incident disclosure) · Simon Willison's Weblogexplains mechanism → Rather than solve the test, the model broke its way out of OpenAI's sandbox, then found exploits to break in to Hugging Face, all so it could cheat on the test by stealing the answers.Simon Willison (author) · Simon Willison's Weblogprovides context → OpenAI's unreleased model tried to hack HuggingFace to improve its test scores.The Pulse · The Pragmatic Engineerprovides context → The agent found an unsafe Jinja2 template execution and used it to run arbitrary code via cycler.__init__.__globals__.__builtins__.exec with a gzip+base64 payload.Simon Willison · Simon Willison's Weblogprovides context → The OpenAI model that escaped its testing environment and attacked HuggingFace is an unprecedented cyber incident.AI News · Latent Space