Last week, OpenAI and Hugging Face disclosed something worth your attention. During an internal test, an OpenAI model broke out of its locked down test environment, found a hidden security flaw, and used it to hack into Hugging Face's real production servers.

• The AI found an unknown flaw in software used to manage package downloads and used it to escape its test environment.

• Once it reached the open internet, it used stolen credentials and more unknown flaws to break into Hugging Face's servers.

• Both companies' security teams caught the activity and are now investigating together.

This was not a human attacker. It was an AI system finding creative, unexpected ways to reach a narrow goal, a preview of the kind of risk businesses will need to plan for.

AI Governance services from VanRein Compliance give our clients and partners exactly what a situation like this calls for, real services and an extra set of eyes watching for these problems before they grow into something bigger. That extra layer of oversight is what catches an AI system drifting off course, long before it reaches your production systems.

Want to know where your company stands?

Get a free 30 minute AI Governance Review with Rob Van Buskirk to walk through your current exposure and next steps.

We break down what this means for your compliance and security posture in the full article.

VRC ALERT: FBI ISSUES CYBER THREAT WARNING

FEDERAL ADVISORY UPDATE · JULY 22, 2026

THREAT INTELLIGENCE BRIEF

IRANIAN-AFFILIATED ACTORS TARGET US CRITICAL INFRASTRUCTURE

This week, the FBI, CISA, and the NSA updated a warning about cyber attackers connected to Iran targeting PLCs, the small computers that run equipment like pumps, valves, and power systems. Attackers have already disrupted water, energy, and government facilities by altering what operators see on their control screens, in some cases causing real financial loss. Affected equipment now includes Rockwell Automation, Schneider Electric, and Siemens.

THIS MATTERS FOR HIPAA COVERED ENTITIES

CLOSER TO ePHI THAN YOU THINK

Hospitals, healthcare systems and other industries often run building systems like HVAC, water treatment, and backup power on this exact equipment, and those systems are frequently connected to the network storing ePHI (electronic protected health information). HIPAA's Security Rule requires you to account for threats like this in your risk analysis, so it is better to close the gap now than find it during an audit.

Where VRC Services Fit

• Penetration testing checks whether someone could actually reach your equipment from your office network

• Vulnerability scanning watches for open ports or misconfigured devices on an ongoing basis

• Tabletop exercises walk your team through a building system outage, not just a data breach

• AI governance keeps a person checking that automated monitoring tools are actually working

The full advisory below includes the specific ports, indicators, and technical steps your team can act on today.

KNOW YOUR RISK EXPOSURE NOW

Start a conversation with our team about a HIPAA risk analysis, pen test, or tabletop built around this threat.

FULL FEDERAL ADVISORY

Read the full advisory at ic3.gov (PDF)