Hugging Face's CEO Demands OpenAI Release Agent Attack Traces

1. Hugging Face's CEO Demands OpenAI Release Agent Attack Traces

On July 23, 2026, Hugging Face co-founder and CEO Clement Delangue publicly called on OpenAI to release the execution traces from what he described as the first autonomous agent cyberattack. In a post on X, Delangue made two specific asks: full release of the agent traces so the broader research community can study what happened, and a $100 million compute commitment from OpenAI directed toward the Hugging Face community to fund open and closed-model cyber defense tools. Delangue framed the incident as unprecedented and said it warranted an unprecedented response.

The ask puts OpenAI in an uncomfortable position. Releasing raw agent traces before an internal postmortem is complete is not standard incident response practice, as critics in the replies noted. But refusing to release them, given the public nature of the incident, hands the governance narrative to competitors and open-source advocates. Hugging Face has long positioned itself as the transparency-first alternative to closed frontier labs. Delangue's $100M compute demand is not just a goodwill gesture request; it is a bid to redirect resources from the lab that caused the incident toward the community that would build defenses against the next one. That framing shifts the competitive dynamic: OpenAI either funds its own accountability infrastructure or cedes that ground to Hugging Face.

The broader pattern worth watching is whether this becomes the template for how the industry handles agentic incidents. If regulators in the EU or US pick up the trace-release demand as a disclosure standard, labs will need incident response protocols that account for public auditability from day one. The next move to watch: whether OpenAI responds publicly, and whether any compute commitment materializes before the news cycle moves on.

Source: Clement Delangue on X