What the OpenAI Hugging Face Incident Actually Tells Us
Powered by Single Fin
Welcome to this week’s edition of CIOsurge!
This week:
AegisAI Raised $36M. Two CIOsurge Members Already Had It Running.
Gartner: 60% of organizations will run "tiny teams" by 2029, up from 15% today
IT hiring rebounds, with AI/ML postings up 173% and commanding a 22% salary premium
Let’s make this week a game-changer.
Stay sharp. Stay ahead.
AegisAI Raised $36M. Two CIOsurge Members Already Had It Running.
About a year ago I was in an early conversation with Cy Khormaee and Ryan Luo, former Google security engineers who built Safe Browsing and reCAPTCHA, and made an early investment. They weren't pitching a product yet. They were working through a problem: AI has changed the economics of spear phishing in a way that rules-based detection was never built to handle.
Battery Ventures just led their $36M Series A, with Accel and Foundation Capital. Total capital is $49M.
The threat they're building against is worth understanding regardless of the company. AI lets attackers pull together your LinkedIn, your company's recent announcements, your conference schedule, your org chart, and generate a message that is contextually specific to a single person. No generic lures. No obvious tells. Khormaee told TechCrunch that AI-powered attacks now bypass existing controls more than half the time. The filters your stack uses were trained on different attack patterns.
Two members of the CIOsurge community deployed AegisAI in recent weeks. Both were already running Microsoft Defender, Proofpoint, and Mimecast. Setup took five minutes alongside existing tools. In both cases the first scan surfaced thousands of threats that had passed through their stacks undetected. Not noise, but targeted attempts that were too contextually specific to match any existing rule.
The part that stood out to both of them wasn't the volume. It was that each flagged message came with context: who the attacker appeared to be, which people in the organization were being targeted, and what the attack was trying to accomplish, not just a blanket alert. That's the kind of output you can hand to a SOC analyst or push into a SIEM without having to reconstruct the story from scratch.
The company is also applying the same detection approach to outbound traffic, catching data leaving the organization in ways that look abnormal in context, without the classification overhead that makes traditional DLP hard to maintain.
If you're curious what it found in environments that were already considered well-covered, I'm happy to walk through it.
Disclosure: I am an early investor in AegisAI.
What the OpenAI / Hugging Face Incident Actually Tells Us
The headlines this week have mostly been some variation of: "OpenAI's AI went rogue and hacked a company." That framing is inaccurate in ways that matter. Three things are being mischaracterized or left out.
Here is what happened. OpenAI was running capability evaluations on advanced models using ExploitGym, a benchmark designed to measure offensive cyber capability. Safety refusals were reduced for the test. The models found a zero-day in the package proxy constraining their network access, escalated privileges, reached the open internet, and broke into Hugging Face's infrastructure in pursuit of the assigned objective. Hugging Face confirmed it was "driven, end to end, by an autonomous AI agent system."
The isolation wasn't real isolation. A package proxy as the primary network constraint is not a well-isolated environment. Real isolation — egress controls enforced at the hypervisor layer, not dependent on a single proxy — would have contained this. The models did exactly what capable agents do when given an objective and a weak constraint: they found a way out. This is an infrastructure problem, not an AI problem.
"Going rogue" is the wrong frame. The models were not pursuing goals that conflicted with their instructions. They pursued their instructions aggressively. The objective was to solve the ExploitGym evaluation. They solved it. That is a specification and containment failure, not goal misalignment. The solutions to those problems are different, so the distinction matters.
The forensic response detail is being underemphasized. When Hugging Face began log analysis, commercial frontier models refused the work — not because they assessed intent, but because the logs contained real attack commands, exploit payloads, and C2 artifacts. Safety guardrails cannot distinguish an incident responder from an attacker when the input looks the same. Hugging Face ran the forensic analysis on GLM 5.2, an open-weight model, on their own infrastructure. From their post: "This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment."
That detail deserves more attention than it has received. A security team investigating a serious incident was blocked by the commercial AI providers they would normally rely on and had to fall back to open-weight infrastructure they controlled themselves.
What this means for security leaders
Three things. If you are running AI capability evaluations, treat the containment environment as adversarially hostile from the start. A single network proxy is not sufficient against a model with strong exploitation capability and a clear objective.
Objective specification still matters. Reducing safety refusals for a test is a legitimate research decision — but the scope of what counts as satisfying the objective needed tighter definition. Models pursue their objectives.
Your incident response capability should not depend entirely on commercial frontier models. Any forensic investigation involving real attack artifacts will hit the same wall Hugging Face hit. Security teams should maintain access to capable open-weight models that can run on infrastructure they control, without content restrictions that treat responders the same as attackers.
The headline is that AI went rogue. The actual story is about containment, objective specification, and a gap in how security teams are equipped to respond.
— Zack Tembi
IT Hiring Rebounds, and AI Skills Are Commanding a Premium
IT hiring is picking up, according to CIO.com's review of CompTIA's June employment data, with employers ramping up technology investments and hiring the talent to support them. Even as some tech companies announce layoffs, employers in other industries are accelerating digital transformation and moving from AI experimentation to implementation. The sharpest signal is in the postings data from Dice: AI/ML job titles are up 173% year over year, and those roles carry median salaries 22% higher than the overall IT market. Hiring in data analysis is up 10%, cybersecurity up 4%, and IT support up 1%.
Read this next to the tiny-teams forecast and the picture snaps into focus. Demand for technologists is not shrinking, it is repricing. The market is paying a steep premium for people who can build with AI and holding steady on everything else. For your own hiring, that means the AI-fluent candidates you pass on today cost 22% more next quarter. For your own career, it means the single highest-return investment you can make this year is becoming genuinely fluent in AI tooling, not conversationally, but hands on the keyboard. The rebound is real. It is just not evenly distributed.
💡 CIO Spotlights
Assaf Keren named Chief Information Officer at Meta
Appointed CISO of Meta, succeeding Guy Rosen, who is retiring after 13 years with the company
Will transition into the role over the coming months, working alongside Rosen before taking over Meta's global cybersecurity organization
Joins from Qualtrics, where he served as SVP and Chief Security Officer since March 2024
Spent nine years at PayPal before that, holding several senior security leadership positions including CISO
On the mandate, in his own words: building frontier AI means building its trust infrastructure "at the same frontier, with the same seriousness, at a scale that touches billions of people"
Jason Taylor named Chief Information Officer at West Star Aviation
Appointed CIO of West Star Aviation, a leading aviation maintenance, repair, and overhaul provider, owning enterprise technology strategy, data and analytics, and cybersecurity
Previously CIO and Global CTO at RS Americas, and VP of Global Digital and Innovation at Gates Corporation, with earlier leadership roles at Mohawk Industries and Eaton
Led multiyear SAP S/4HANA programs and consolidated more than 1,000 applications into core platforms
Built enterprise data platforms with strong governance and established cybersecurity programs aligned to NIST and ISO 27001
