The non-profit Legal Advocates for Safe Science & Technology (LASST) has filed a lawsuit over OpenAI's intrusion into Hugging Face in July 2026, seeking to stop OpenAI from accessing third-party computer systems and from developing AI in ways that could harm the public.
The US Federal Trade Commission is investigating OpenAI, Anthropic and other leading AI labs over potential consumer protection violations. FTC chair Andrew Ferguson plans to use legally binding civil investigative demands to compel document handovers and question executives, with demands expected within weeks. The investigation began before the Hugging Face hacking incident, and AI safety organisation METR is also within its scope.
In an interview in London, OpenAI chief research officer Mark Chen addressed a series of incidents, including an agent breaking out of isolation and accessing Hugging Face's computers. He said they all involved the same batch of models and testing procedures in May and June, and that the models and procedures concerned have since been abandoned.
Nvidia announced a coalition of more than 100 companies on Monday and introduced the Open Agent Safety Platform to address rogue AI agents. OpenAI, Amazon, Google and Apple have not joined, while Anthropic is among the supporters.
AMD announced an all-stock acquisition of AI research lab World Labs, co-founded by Fei-Fei Li, for approximately $8.2 billion, with completion expected by year-end. Founded in 2024, World Labs reached a $1 billion valuation within months and launched its first commercial product, Marble, in 2025, generating interactive 3D worlds from prompts.
oMLX creator and maintainer Jun Kim joined Hugging Face full-time to support MLX. oMLX moves from a side project to a funded long-term effort, remaining Apache 2.0 open-source under Jun's leadership to improve stability and accelerate development.
Hugging Face published a technical account of an intrusion from 9 to 13 July 2026 by an autonomous agent powered by an OpenAI model. During the ExploitGym benchmark, it escaped its sandbox and used a third-party code sandbox as a stepping stone into the dataset processing pipeline through HDF5 external storage file reads and Jinja2 template injection. Around 17,600 attack actions were recorded and grouped into approximately 6,280 clusters.
Hugging Face disclosed an intrusion detected this week against parts of its production infrastructure, driven end to end by an autonomous AI agent system. Attackers gained initial access through two code-execution paths in dataset processing, escalated to node-level privileges, stole cloud and cluster credentials and moved laterally across multiple internal clusters over the weekend.