OpenAI breaches Hugging Face, PyPI locks stale releases, Nunchaku halves VRAM

Sources

OpenAI’s accidental cyberattack against Hugging Face is science fiction that happened simonwillison.net

This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model’s guardrail features turned off. Rather than solve the test, the model broke its way out of OpenAI’s sandbox, then found exploits to break in to Hugging Face, all so it could cheat on the test by stealing the answers. Along the way it helped make the strongest case yet for how the imbalance of model availability is hurting our ability to secure our software. Here’s what ha…

Quoting Thomas Ptacek simonwillison.net

I genuinely believe that if you took an open weights model from 2025 and built a pentest harness for it, it could do this kind of sandbox escape and scan/hack in most networks. This is only surprising because you assume OpenAI has sounder sandboxes. — Thomas Ptacek , doesn’t think this even needs a frontier model Tags: thomas-ptacek , openai , security , generative-ai , ai-security-research , ai , llms , sandboxing

Bringing Nunchaku 4-bit Diffusion Inference to Diffusers huggingface.co

Quoting Seth Larson simonwillison.net

The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren’t aware it was possible. — Seth Larson , PyPI blog Tags: packaging , python , supply-chain , pypi , seth-mi…

Are AI labs pelicanmaxxing? simonwillison.net

Dylan Castillo ran 48 animal-vehicle prompts three times across 7 frontier models, including GPT-5.6 Terra, Claude Sonnet 5 and Gemini 3.5 Flash, and found no lab draws pelicans on bicycles better than its other animal-vehicle combos predict. GLM-5.2 came closest but the effect was statistically insignificant.

References

Hacker News discussion (item 48997548) news.ycombinator.com

Some users documenting over 80 mentions of the word ‘marketing’ in a single discussion thread… Critics argue the incident feels like a manufactured ‘hype cycle’ intended to portray OpenAI’s technology as ‘dangerously powerful’ to justify massive venture capital valuations or to pressure regulators into restrictive licensing that favors established labs.

Berkeley RDI blog on ExploitGym rdi.berkeley.edu

GPT-5.5 captured 210 flags despite only 120 being for the ‘correct’ targets… when agents were given a 6-hour budget instead of the standard 2-hour window, successes for Claude Mythos Preview jumped from 127 to 204, suggesting that current benchmarks may fundamentally underestimate long-horizon AI capabilities.

VentureBeat security coverage venturebeat.com

Former AWS Deputy CISO Merritt Baer noted that this highlighted a structural ‘asymmetry problem’ where attackers operate without constraints while defenders are disarmed by the safety filters of their own tools.

South China Morning Post scmp.com

By hosting the [GLM-5.2] model locally on its own infrastructure, the security team bypassed the restrictive filters of Western API providers. This allowed for the rapid reconstruction of the attack timeline and the identification of compromised credentials within hours rather than days.

SOCRadar analysis socradar.io

Security analysts have identified Sonatype Nexus Repository 3 as the primary candidate, pointing to CVE-2026-14646 (an SSRF via HTTP redirect) as the likely exploit used to gain network access. Other market analysts from Raymond James suggested the vendor could be JFrog.

SC World / Thomas Ptacek quoted scworld.com

I genuinely believe that if you took an open weights model from 2025 and built a pentest harness for it, it could do this kind of sandbox escape and scan/hack in most networks. This is only surprising because you assume OpenAI has sounder sandboxes.

Help Net Security helpnetsecurity.com

Only about 56 of the top 15,000 packages had uploaded wheels more than 14 days after a release, suggesting the real-world impact on legitimate workflows is narrow.

ogwilliam.com — durabletask post-mortem blog.ogwilliam.com

Attackers bypassed GitHub repository security entirely by stealing a legacy PyPI API token from a compromised developer account, then published malicious versions 1.4.1–1.4.3 that harvested credentials from AWS, GCP, and Azure.

ReversingLabs — ultralytics compromise reversinglabs.com

Attackers exploited a GitHub Actions script injection to steal PyPI API tokens and publish versions of the ultralytics AI library containing cryptocurrency miners.

PEP 694 draft (python/peps) github.com

Upload sessions allow an sdist and all its corresponding wheels to be published atomically, and support staged previews that hold uploads in a non-public state for asynchronous malware scanning before they become installable.

PyPI Trusted Publishers security model docs.pypi.org

Trusted Publishing eliminates long-lived API tokens by using short-lived OIDC identity tokens issued directly from CI providers, removing the class of secret whose theft enables release poisoning.

CrowdStrike — ctx/phpass analysis crowdstrike.com

The ctx package was hijacked after an attacker re-registered the original maintainer’s expired email domain to reset account passwords, then added code to exfiltrate AWS access keys from environment variables.

SVDQuant paper (arXiv 2411.05007) arxiv.org

naively running the low-rank branch with rank 32 would introduce 57% latency overhead due to redundant activation memory access; Nunchaku fuses its kernels with the low-bit branch to cut that overhead.

GitHub issue nunchaku-ai/nunchaku #911 github.com

Illegal memory access encountered in svdq_quantize_w4a4_act_fuse_lora_cuda on Blackwell (SM120); the launch appears to succeed but corrupts the CUDA context so later cuBLAS calls fail with CUBLAS_STATUS_NOT_SUPPORTED.

Medium — ‘FLUX without tears’ Nunchaku/ComfyUI checklist medium.com

installing via ComfyUI Manager routinely produces ‘red error’ nodes because the PyPI ‘nunchaku’ package is unrelated; users must hand-pick wheels matching their exact Python/CUDA/torch ABI.

SVDQuant v4 (arXiv) — LoRA integration arxiv.org

Nunchaku fuses off-the-shelf LoRA adapters into the 4-bit base at runtime without re-quantization, and on a 16GB laptop RTX 4090 delivers up to 8.7× end-to-end speedup vs BF16 by eliminating CPU offload.

DeltaQuant (CVPR 2026, thecvf.com) vertexaisearch.cloud.google.com

SVDQuant’s static per-channel smoothing, calibrated at a fixed timestep, can exacerbate outliers at later denoising steps; DeltaQuant reports PSNR 30.1 / SSIM 0.903 on Wan2.2 first-frame vs SVDQuant’s 27.7 / 0.816.

OpenReview ICLR 2025 reviews of SVDQuant openreview.net

reviewers noted the individual pieces (SmoothQuant-style migration, SVD low-rank residual) are not novel in isolation and questioned the sensitivity of the outlier-migration parameter λ to different calibration datasets.