OpenAI accidentally Hacked Hugging Face - 2026-07-27

This week, the crew digs into one of the biggest AI security stories of the year: how an OpenAI autonomous agent accidentally compromised a Hugging Face environment during testing and what the incident reveals about the growing risks of agentic AI. They examine how AI models behave in offensive security scenarios, discuss emerging attack surfaces around MCPs and AI agents, explore the challenges of AI red teaming, and debate what organizations should be doing today to secure AI-powered workflows. The episode also covers AI safety initiatives, model behavior, and where defensive security is struggling to keep pace with rapidly evolving AI capabilities.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴event-live-chatChapters(00:00) - PreShow Banter™ — Sol with a Goal (06:33) - OpenAI accidentally Hacked Hugging Face - 2026-07-27 (09:18) - Story #1 - OpenAI says it accidentally hacked Hugging Face with a new AI system (18:33) - Story #2 - Lapsus is shutting down (24:21) - Story #3 - AgentForger, Part 1: ChatGPT Cross-Site Agent Forgery (31:47) - Story #4 - Beyond the Terminal: Offensive Security Evals for Embodied Reasoning (44:00) - Story #5 - EXPLOIT BROKERS PAY $500,000 FOR A WORDPRESS RCE. I FOUND ONE WITH GPT5.6 SOL ULTRA AND $25 (52:43) - Story #6 - DNS Poisoning Tactics Expand to Hospitality Wi-Fi (55:51) - Ads and Mike at the AI Summit (59:54) - Story #7 - Golden Chickens Resurfaces With Four New Malware Families and Modular Implants LinksStory #1 - OpenAI says it accidentally hacked Hugging Face with a new AI systemStory #2 - Lapsus is shutting downStory #3 - AgentForger, Part 1: ChatGPT Cross-Site Agent ForgeryAgentForger, Part 2: The Autonomous InsiderStory #4 - Beyond the Terminal: Offensive Security Evals for Embodied ReasoningStory #5 - EXPLOIT BROKERS PAY $500,000 FOR A WORDPRESS RCE. I FOUND ONE WITH GPT5.6 SOL ULTRA AND $25Story #6 - DNS Poisoning Tactics Expand to Hospitality Wi-FiAds and Mike at the AI SummitStory #7 - Golden Chickens Resurfaces With Four New Malware Families and Modular ImplantsCreators &amp; Guests Ads Dawson - Guest Mike Takahashi - Guest Corey Ham - Host John Strand - Host Bronwen Aker - Host Hayden Covington - Host Ralph May - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts &amp; Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.com☯️ Introducing BHIS Fusion Penetration Testing<a href="https