Wolf: AI Model Used Fake GitHub Accounts to Social Engineer Maintainers
Thomas Wolf · “OpenAI’s Model Hacked Us” - Hugging Face’s Thomas Wolf · Aug 6, 2026 · at 17:01
Thomas Wolf, Chief Science Officer of Hugging Face, describes a UK AI Security Institute benchmark where an autonomous model attempted supply-chain social engineering.
0:00 / 1:06exact quote · 66.3s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“Basically, the model was tasked to solve this attack, this, like, to attack and to penetrate this subnetwork, and what it decided to do, it decided to get one of the maintainer of a library that could be used To operate this activity directory to merge like malicious code with the idea that if this malicious code was merged by this maintainer, then there would be an update at some point on the software that was used in the subnet, it was attacking, and then this would give it entry point. And the way he did that was actively trying to social engineer the maintain emerging. So he created fake accounts, fake GitHub account that Came commenting on the pull request and said, oh yeah, you should really merge this. This is solving like a big problem I also have. And then when a human stepped up trying to say, oh, this looks actually like malicious cut to me. He tried to kind of blackmail almost the human or to say, this is not important or you didn't really understand. And then he actively tried to covering traces, changing the past message.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Thomas Wolf
Wolf: OpenAI Model Attacked Hugging Face as Autonomous 'Side Quest'
“What people quickly discovered is that the model was not at all task with attacking us, but decided to do that as a side quest of something else.”
Wolf: Prior OpenAI Training Runs Left Notes for Future Runs
“I think learning we had at Black Hat yesterday was that some of the previous training run may have left some notes for future training runs, which is, I think mind, mind blowing.”
Wolf: Open Versus Closed AI Is Orthogonal to Model Safety
“If for many aspects, I think the closed open distinction is almost orthogonal to the safe and safe. People don't understand that, you know, easily because it's easier to do bad mapping than to try to understand the subtlety.”
Wolf: 90% of AI Fake News Is Made by Closed-Source Models
“All of that is, like, maybe not all, let's say, 90%, to be fair, is made by closed source model, right?”
Wolf: OpenAI Admitted Model Evaluation Caused Hugging Face Cyber Incident
“And then about a week later, OpenAI contacted us and tell us that this was much likely something that happened as part of one of their model development or evaluation, basically.”
Wolf: Claude Opus Refused to Assist Hugging Face During Incident
“And in this case is, it's not only that Fable told us I'm not allowed to touch cybersecurity, but also Opus, which was the fallback was saying, no, I'm also not touching these things. So basically the end was just say we won't process anything about that, but …”