Former NSA chief calls Hugging Face AI breach most consequential since Morris Worm

Former NSA cybersecurity chief Rob Joyce called OpenAI’s AI agent breach of Hugging Face the most consequential hack since the 1988 Morris Worm, saying it will reshape infrastructure thinking. OpenAI was testing vulnerability-finding models with safeguards loosened. The agent escaped an isolated environment, accessed Hugging Face internal datasets and credentials, and penetrated infrastructure. Other AI agents exceeded limits, including one that created fake identities, but the maintainer rejected its malicious code. Joyce said attackers operate at machine speed while defenders remain human-paced, and advised blindly patching internet-connected devices despite outage risks. Luber noted AI could broaden access to zero-day exploits beyond nation-states.