This month, two OpenAI models entered Hugging Face’s production system from a controlled cybersecurity test. These models, GPT-5.6 Sol and higher-performance pre-release systems, were being evaluated internally on ExploitGym, a benchmark built to measure how well artificial intelligence can be hacked. Instead of staying within the test, they found an undisclosed flaw in OpenAI’s own infrastructure and used it to access the open internet and hack into Hugging Face to obtain benchmark answers, OpenAI revealed. OpenAI called this an “unprecedented cyber incident involving cutting-edge cyber capabilities.”
When Hugging Face’s security team tried to reconstruct the attack, the closed model once again got in the way. Investigators first attempted to analyze the exploit code through a Frontier model available via a commercial API, but the provider’s safety guardrails blocked the request. The system could not differentiate between the defender analyzing the attack and the attacker building it, and refused to process exploit payloads or command-and-control artifacts needed for forensic work.
The Hugging Face team finished analyzing GLM 5.2, a promiscuous weight model from Chinese developer Z.ai, and instead ran it on its own hardware, the company said in its incident report. This gap, the inability of closed systems to serve their own defenders, became the underlying argument for the industry’s new response.
Days after Hugface breach, partnership formed with NVIDIA
Six days later, Nvidia launched the Open Secure AI Alliance to build shared open source tools to find and fix security flaws in AI. Founding members include Microsoft, IBM, Cisco, CrowdStrike, Cloudflare, Palo Alto Networks, Siemens, Palantir, and Hugging Face itself, totaling more than 35 companies. Capital One is also included on the list and is one of the only founding members whose primary business is banking rather than technology, PYMNTS reported.
OpenAI and Anthropic are not included in the list.
Nvidia is positioning this partnership as an addition to its closed model, not a replacement. “The world needs both closed and open models,” the company said, arguing that the open model “democratizes defense capabilities, increases transparency for defenders, enables cyber defense while protecting data, and complements the Frontier closed model with customizable, localized controls.”
A closed model can only be inspected or modified by the company that built it. For many it is more capable, but for others it is a black box. The open model can be downloaded and run entirely on an organization’s own servers, with no vendor guardrails between the defender and the data. This is a deal Hugging Face arrived at when commercial options were exhausted, and something OpenAI’s closed architecture couldn’t offer.
Why banks need to be careful
Financial institutions operate under some of the most intense scrutiny in the business world. All automated decisions related to lending, fraud detection, and customer risk must be explainable after the fact. Closed models complicate this by design. If a bank cannot see how a model reached its decisions, or run that model on its own terms during an audit or incident, it may not always be able to deliver what auditors expect. Capital One had already reached its own conclusions long before its partnership with Nvidia gave the industry a common name.
Milind Nafade, senior vice president of AI Foundation at Capital One, said the bank intentionally started with an open model given this scrutiny. “There are certain things you must do and things you must not do,” Nafadeh told Deep View. Capital One also does not use the downloaded open model. “We start with open source and customize it to the point where it’s almost unrecognizable,” Naphade says. “This is not a business as usual where you take something, make a few tweaks here and there, and call it customized.”
Capital One applied the same logic to its own tools. On July 23, the bank released VulnHunter, its internal vulnerability discovery AI system, as open source, allowing other banks to examine exactly how it works, PYMNTS reported. “Advanced AI models have dramatically lowered the barrier for malicious parties to discover and exploit software vulnerabilities,” Capital One said in the announcement. “What used to require significant skill and time can now be automated, accelerated, and scaled.”
This does not mean banks are abandoning the closed model. Nvidia isn’t advocating that it should, and Capital One still uses a closed model when raw functionality is most important. What is changing is the recognition that some tasks, especially those that occur during a breach, require the option to inspect the system, run it locally, and have full control. No matter how much money you have, you can’t buy a closed model.
