> they would be perfectly capable of keeping it just between themselves and not putting out press releases about it.
In some jurisdictions there are legal requirements about disclosing cybersecurity incidents, and it's a well-established best practice even where there aren't. Beyond that, HuggingFace appears to have put out a press release about this before they knew this was a rogue OpenAI model: https://huggingface.co/blog/security-incident-july-2026
Of course, if it's all a big conspiracy, perhaps they were just not saying what they knew in order to help OpenAI's marketing later. Or it never happened at all, or whatever.
I do disagree that this is good PR, but I don't see the point in having that argument here--I just want to correct straightforward misinformation.