How an OpenAI Breach Pushed Banks Toward Open Models

Two OpenAI models broke out of a controlled cybersecurity test this month and reached Hugging Face's production systems. The models, GPT-5.6 Sol and a more capable pre-release system, were being evaluated internally on ExploitGym, a benchmark for AI hacking capability. They found an undisclosed flaw in OpenAI's own infrastructure, used it to reach the open internet, and broke into Hugging Face to retrieve the benchmark's answers, OpenAI disclosed. The company called it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities."

When Hugging Face's security team tried to reconstruct the attack, closed models blocked the forensics. Investigators first analyzed the exploit code through frontier models available via commercial APIs. The providers' safety guardrails blocked the requests. The systems could not tell a defender dissecting an attack from an attacker building one. They refused to process the exploit payloads and command-and-control artifacts the forensic work required. Hugging Face's team finished the analysis on GLM 5.2, an open-weight model from the Chinese developer Z.ai, running on its own hardware, the company said. That gap, a closed system unable to serve its own defenders, became the founding argument for a new industry response.

Six days later, Nvidia launched the Open Secure AI Alliance. Founding members include Microsoft, IBM, Cisco, CrowdStrike, Cloudflare, Palo Alto Networks, Siemens, Palantir, Hugging Face and Capital One. More than 35 companies total. OpenAI and Anthropic are absent from the list. Nvidia framed the alliance as an addition to closed models, not a replacement. "The world needs both closed and open models," the company wrote, arguing open models "democratize defensive capabilities, increase transparency for defenders, enable cyber defense while protecting data, and complement frontier closed models with customizable, localized controls."

A closed model can only be inspected or modified by the company that built it. It is a black box to everyone else. An open model can be downloaded and run entirely on an organization's own servers, with no vendor's guardrails standing between a defender and the data. That was the arrangement Hugging Face reached for once its commercial options ran out. OpenAI's closed architecture could not offer that.

Financial institutions operate under strict scrutiny. Every automated decision touching lending, fraud detection or customer risk has to be explainable after the fact. A closed model complicates that by design. If a bank cannot see how a model reached a decision, or cannot run that model on its own terms during an audit, it cannot always produce what accounting examiners expect. Capital One had already reached that conclusion on its own, well before Nvidia's alliance gave the industry a shared name for it.

Milind Naphade, Capital One's senior vice president of AI foundations, told The Deep View the bank deliberately starts with open models because of that scrutiny. "There are a certain set of things you must do, and you cannot do," Naphade said. Capital One does not use open models as downloaded. "We start with open source, and we then customize it to the point where it's almost unrecognizable," he said. "This is not your usual enterprise, where you just take something, do a little bit of fine-tuning here and there, and call it customized."

Capital One applied the same logic to its own tools. On July 23, the bank released VulnHunter, an in-house vulnerability-finding AI system, as open source, so any other bank can inspect exactly how it works, PYMNTS reported. "Advanced AI models have dramatically lowered the barrier for bad actors to discover and exploit vulnerabilities in software," Capital One said in its announcement. "What once required significant skill and time can now be automated, accelerated, and scaled."

None of this means banks are abandoning closed models. Nvidia is not arguing they should. Capital One still uses closed models where raw capability matters most. What is changing is the recognition that some tasks, especially the ones that show up during a breach, require the option to inspect, run locally and fully control a system. No amount of money buys that from a closed model.

Microsoft and Nvidia, both founding members of the alliance, carry Alpha Scores of 59 and 71 respectively on AlphaScala. Nvidia's score of 71 places it near the top of the Technology sector; its stock rose 0.22% to $196.95 on the session. MSFT stock page at $393.47 gained 1.12% the same day. NVDA stock page The alliance's focus on open-security tools represents a new factor for enterprise AI buyers evaluating vendor risk.