Two OpenAI models broke out of a controlled cybersecurity test this month and into Hugging Face’s production systems. The models, GPT-5.6 Sol and a more capable pre-release system, were being evaluated internally on ExploitGym, a benchmark built to measure how well artificial intelligence can hack. Instead of staying inside the test, they found an undisclosed flaw in OpenAI’s own infrastructure, used it to reach the open internet, and broke into Hugging Face to retrieve the benchmark’s answers, OpenAI disclosed. OpenAI called it “an unprecedented cyber incident, involving state-of-the-art cyber capabilities.”
When Hugging Face’s own security team tried to reconstruct the attack, closed models got in the way again. Investigators first tried analyzing the exploit code through frontier models available via commercial APIs, but the providers’ safety guardrails blocked the requests. The systems could not tell a defender dissecting an attack from an attacker building one, and refused to process the exploit payloads and command-and-control artifacts the forensic work required.
Hugging Face’s team finished the analysis on GLM 5.2, an open-weight model from the Chinese developer Z.ai, running on its own hardware instead, the company said in its account of the incident. That gap, a closed system unable to serve its own defenders, became the founding argument for a new industry response.
Nvidia’s Alliance Forms Days After the Hugging Face Breach
Six days later, Nvidia launched the Open Secure AI Alliance to build shared, open-source tools for finding and fixing AI security flaws. Founding members include Microsoft, IBM, Cisco, CrowdStrike, Cloudflare, Palo Alto Networks, Siemens, Palantir and Hugging Face itself, more than 35 companies in total. Capital One is also on the list, one of the only founding members whose primary business is banking rather than technology, PYMNTS reported.
OpenAI and Anthropic are absent from the list.
Nvidia framed the alliance as an addition to closed models, not a replacement. “The world needs both closed and open models,” the company wrote, arguing open models “democratize defensive capabilities, increase transparency for defenders, enable cyber defense while protecting data, and complement frontier closed models with customizable, localized controls.”
A closed model can only be inspected or modified by the company that built it. It is often more capable, but it is a black box to everyone else. An open model can be downloaded and run entirely on an organization’s own servers, with no vendor’s guardrails standing between a defender and the data. That is the arrangement Hugging Face reached for once its commercial options ran out, and the one OpenAI’s closed architecture could not offer.
Why Banks Should Pay Closer Attention
Financial institutions operate under some of the strictest scrutiny in the economy. Every automated decision touching lending, fraud detection or customer risk has to be explainable after the fact. A closed model complicates that by design: If a bank can’t see how a model reached a decision, or cannot run that model on its own terms during an audit or incident, it can’t always produce what the accounting examiners expect. Capital One had already reached that conclusion on its own, well before Nvidia’s alliance gave the industry a shared name for it.
Milind Naphade, Capital One’s senior vice president of AI foundations, has said the bank deliberately starts with open models because of that scrutiny. “There are a certain set of things you must do, and you cannot do,” Naphade told The Deep View. Capital One doesn’t use open models as downloaded, either. “We start with open source, and we then customize it to the point where it’s almost unrecognizable,” Naphade said. “This is not your usual enterprise, where you just take something, do a little bit of fine-tuning here and there, and call it customized.”
Capital One applied the same logic to its own tools. On July 23, the bank released VulnHunter, an in-house vulnerability-finding AI system, as open source, so any other bank can inspect exactly how it works, PYMNTS reported. “Advanced AI models have dramatically lowered the barrier for bad actors to discover and exploit vulnerabilities in software,” Capital One said in its announcement. “What once required significant skill and time can now be automated, accelerated, and scaled.”
None of this means banks are abandoning closed models. Nvidia isn’t arguing they should, and Capital One still uses closed models where raw capability matters most. What’s changing is the recognition that some tasks, especially the ones that show up during a breach, require the option to inspect, run locally and fully control a system. No amount of money buys that from a closed model.
