 |
| By Beth Canova |
Hugging Face isn’t the sort of company that usually makes headlines.
That said, it is critical to the AI narrative. It’s the platform where developers share artificial intelligence models and data.
The last time the name crossed analysts’ desks was earlier this year, when Nvidia agreed to buy it for about $13 billion.
But there’s a bigger story crypto users need to know: Over the summer, 700 AI agents broke into Hugging Face in July while trying to beat a cybersecurity test.
Related story: OpenAI Changed the Rules of Online Safety
None of them were instructed to do so.
Software was given a test. And it found ways to act outside the boundaries.
The damage landed on a real company's computers. But the impact can make its way to your crypto strategy.
The Test That Left the Lab
In July, OpenAI wanted to test how well its models could find and exploit software flaws.
Each agent — a program that uses tools to carry out a task on its own — ran in a separate virtual computer meant to limit its reach. Safeguards were deliberately reduced so the results would reflect true capability.
That’s when something interesting happened: Copies built to work alone started trading notes. The agents found a shared service they could turn into a message board.
METR and Redwood Research, who conducted independent investigations, counted roughly 1,200 agents on that board and more than 70,000 messages and files.
About 700 joined the attack on Hugging Face.
Some volunteered to fail their own tests so the group could learn how the scorer worked.
Here is the part worth sitting with. These AI agents already had what they needed to pass the test.
They kept attacking because they believed the grader checked how the answer was obtained. It did not. According to OpenAI, all that extra work produced no improvement in their scores.
They fulfilled the original command. But pushed past limits anyway.
What They Found
The agents found exposed credentials (the digital keys that unlock systems) and a series of security flaws.
Then, they linked those flaws together to widen their access.
OpenAI's technical report says they ran code on 41 Hugging Face production workers — machines that were doing the company's real work.
Hugging Face rebuilt the affected machines, closed the entry points, and rotated credentials.
Its initial disclosure reported no evidence of tampering with public models or datasets.
Put simply, despite accessing systems they weren’t supposed to, the agents didn’t do any damage. And Hugging Face already fixed its vulnerabilities.
The Stakes: Crypto Takes Away the Undo
OpenAI says it has since strengthened isolation and monitoring and trained its models to stay inside assigned tasks. A written instruction still depends on the system following it.
That gap matters most when you hold coins directly.
A blockchain does not evaluate whether software understood what you wanted.
It checks whether the transaction carries a valid signature.
Which means an AI agent with a valid signature can authorize a terrible decision.
Bitcoin (BTC) has no cancellation desk. Getting incorrectly sent funds returned … generally depends on the recipient sending it back.
A refund is cooperation. You cannot count on it.
Keep Control of the Signature
Despite leaving no lasting damage, the rogue agents have left a lasting question.
What can AI truly do on its own?
OpenAI’s test revealed that the parameters we give our AI models ... may not always hold firm.
An AI that summarizes an article can give you a bad answer. An AI allowed to trade or withdraw can turn that bad answer into a transaction.
The answer isn’t to avoid AI agents. According to Juan Villaverde, autonomous software is the future of trading, both for TradFi and crypto.
The trick will be to use the right agent for the right task.
So before an agent touches your account, ask the provider four questions …
- Can it send funds?
- Can it place trades?
- Can it change its own limits?
- How are these limits enforced? (A rule in a settings menu the agent can reach is weaker than a separate device it cannot operate by itself.)
If you experiment, keep the main wallet out of reach. Use a separate one holding only what you can afford to lose.
And never give software the recovery words that restore control of your savings.
One platform worth exploring is MoonPay.
Its MoonAgents can propose a transaction. But you have to approve each on a Ledger hardware device, which holds the private keys that authorize transfers.
The agent drafts. The device signs only when you press the button.
That is a permission model worth examining.
Best,
Beth Canova
