Source: Off Message
The cyberattack on Hugging Face, disclosed by OpenAI, revealed that attackers accessed credentials and potentially training data from one of the AI industry's most critical infrastructure points. The incident barely registered as urgent until details emerged. The gap between what happened—real compromise of foundational ML resources—and how the industry initially treated it exposes a governance problem. AI companies operate with security practices designed for an earlier era, when breaches didn't directly compromise the model weights and training pipelines that power the entire ecosystem. Executives are managing optics instead of risk, leaving the entire supply chain exposed.