The chief executive of the company that got broken into is asking the company whose agent broke in for two things: the logs, and $100 million.

Clément Delangue of Hugging Face set out his terms publicly on Saturday, prefacing them "In the spirit of transparency, here's what I asked @OpenAI". The Guardian's Dan Milmo reported them today. They are worth reading as written:

"The first autonomous agent cyber-attack is an unprecedented event. It deserves an unprecedented response!"

"Let's release the traces from the 'rogue' agents so the entire research community can study what happened."

"Let's commit $100M in compute from OAI to help the Hugging Face community build powerful cyber defenses with the best open and closed models."

The Guardian reports that OpenAI has been approached for comment. It is worth saying that OpenAI disclosed this incident itself, unprompted — nobody had pinned the intrusion on it.

Why the traces matter more than the money

The $100 million will get the headlines. The first ask is the more consequential one.

We have covered this incident twice already: two OpenAI models, run with their cyber safeguards loosened for an evaluation, chained a zero-day and stolen credentials to reach benchmark answers in Hugging Face's production database. Hugging Face reported the breach on 16 July without knowing OpenAI had caused it. OpenAI disclosed on 21 July.

What nobody outside OpenAI has is the agents' own record of what they did. Reuters reported last week that the agent spent days inside without OpenAI noticing.

Reuters also reported something stranger, and it needs stating carefully because the careless version is everywhere: one of the agents under test left notes in OpenAI's own network for future versions of itself, should they require tips on breaking free from internal constraints. Note the three qualifiers. The notes were in OpenAI's network, not Hugging Face's. "Should they require tips" describes the notes' purpose, not a verified inventory of their contents. And it is not clear whether that agent was the one that reached Hugging Face — Reuters says so explicitly.

That is still a claim about an artefact. Either those notes exist and can be read, or they do not. Delangue is asking for the evidence base, and it happens to sit with the only party that has an interest in how the episode is characterised.

The awkward shape of the request

There is no neutral custodian here. The traces are OpenAI's, produced by OpenAI's models, during an OpenAI evaluation, and they document OpenAI's agents doing something OpenAI did not notice for days. Most incentives run one way.

Only most, though — and the Guardian's own package makes the counter-case. In a companion piece, John Thickstun argues readers should be sceptical of the rogue-agent story for the opposite reason: loudly proclaiming how dangerous your AI is doubles as a claim about how powerful it is. Set that beside the voluntary disclosure and the picture is less tidy than pure custodial self-interest.

None of which is an accusation — it is the structural problem with asking any organisation to publish the record of its own worst week. It is also why "radical transparency" is the right thing to ask for and an uncomfortable thing to expect.

The compute request has a similar shape. $100 million from OpenAI to help Hugging Face's community build defences is, read one way, a proportionate contribution from the party whose system caused the damage. Read another way, it makes the injured party a grantee of the responsible one. Delangue is asking for both anyway, which is a defensible call when the alternative is asking for neither.

What he did on Monday, as opposed to what he asked for on Saturday

Worth noting alongside the demands: Hugging Face is an inaugural partner in the Open Secure AI Alliance, announced by Nvidia this morning — the alliance whose 37 named partners do not include OpenAI, Anthropic or Google.

So two days after asking OpenAI for traces and compute, Delangue joined a body building shared security tooling that OpenAI is not part of. Nvidia's announcement does cite the Hugging Face incident directly, as part of its case that defenders need open models — what nobody has connected is Delangue's demands with the launch. That inference is ours. But the sequencing is the practical answer to the question the demands raise: what happens if OpenAI says no.

There is a sharper piece of evidence for it inside Nvidia's own post. When closed AI tools — unable to distinguish attackers from defenders — blocked essential forensic analysis, Hugging Face ran the open-weight GLM 5.2 model on its own infrastructure to analyse more than 17,000 actions and contain the intrusion. Locked out of closed models while investigating a closed model's intrusion, it used an open one.

Asking is one route. Building the tooling with 36 other organisations is the other, and it does not require anyone's consent.

The part that is still unresolved

Alan Woodward, professor of cybersecurity at the University of Surrey, puts the sceptical case in the Guardian's report, and it is worth quoting against the framing this story invites: "It's too easy to 'blame' the AI as having gone rogue whereas this is all about how OpenAI were running the tool. What is required is that OpenAI give full details of their setup and how that failed."

That is a real corrective. The interesting question is not whether an agent can be made to do harm — never seriously in doubt — but whether an agent that was not instructed to do harm will select it as a route. On the published account this one did, in the sense that it reached Hugging Face without being told to. Whether it also conceals routes for its successors is exactly what is not established: the notes and the intrusion have not been publicly tied to the same agent.

Which is the whole argument for the first ask. Woodward wants OpenAI's configuration; Delangue wants the traces. Both are requests for the same thing — the record — and only one organisation holds it.