Yes, the labs did not secure their sandbox properly.

And yes, there should be an appropriate law response to the hacking incidents. If for nothing else, to 1) not set precedent of inaction, and 2) get full logs of what happened instead of relying on the labs' "kindness" to offer the information they want.

But also, the agents absolutely went rogue.

Anyone skeptical should go read the METR report [0].

The Hugging Face hacking incident was a shot across the bow. And in hindsight possibly the best thing to have happened in this era. If their security was tight enough, we would still be in the dark. So we (outsiders) should rejoice that it wasn't, that one time.

We can push for accountability for the labs, while also not be in denial of the power and nature of the new models.

[0] https://metr.org/hugging-face-incident-report-aug-2026.pdf