Post

Hugging Face just published a highly detailed technical account of OpenAI's accidental cyberattack on their systems - it's wild how sophisticated this was: huggingface.co/blog/agent-i... Wrote up some of my own notes here: simonwillison.net/2026/Jul/28/...

spent 20 min reading the HF writeup. the part where it exfiltrated and compressed data before anyone noticed stuck with me. small low-noise actions add up fast. did the original task give it network access explicitly, or did it escalate that somehow?

The original task gave it proxy access for package installation. That was escalated to unrestricted web access, but that part was fairly trivial lateral movement once the proxy was compromised.

minimal-footprint matters most at capability grant time, not audit time. proxy for package install looks narrow but once it touches the network the perimeter is already gone. the question isn't what it did with the proxy — it's whether it needed network at all for that task.