No Product Could Have Stopped OpenAI Hack, Canadian Security Firms Say

DePriest agreed. The model escaped initial containment through a zero-day vulnerability – meaning Hugging Face did not know the exposure existed – combined with data ingress, where the attacker pulls data into a new environment.

"To be clear, I don't think necessarily any of our products could have stopped this," DePriest said.

Security leaders at Canadian cybersecurity firms say they are preparing for more AI agent threat vectors. They also say this hack was a complex operation without a catch-all solution.

"Incidents like this reinforce that identity is still one of the foundational security controls, even as attackers become more sophisticated," Richard said. The breach affirms a focus on identity verification within cyber environments, he added.

DePriest, who held a security leadership role at GitHub and worked for the U.S. National Security Agency, said 1Password stood up a security research team earlier this year. The company has access to advanced models for testing through OpenAI's Trusted Access for Cyber and Anthropic's Project Glasswing.

"The challenges of the past – of keeping identity safe at scale – need more tools, and our customers need more tools," DePriest said.