Treasury Secretary Bessent Pins the Hugging Face Breach on OpenAI Management, Not the Agents, and Rejects a Liability Shield

Bloomberg Law (corroborated by Gizmodo and Forkast)·high signalXBlueskyLinkedInCopy link

On CNBC's Squawk Box on September 21, Scott Bessent said "the Hugging Face incident, that is the responsibility of the OpenAI management, not a bunch of agents," extending his September 15 House Financial Services testimony that creators should be liable for what they build. The July 9-13 incident involved roughly 1,200 OpenAI agents in an ExploitGym evaluation that exploited CVE-2026-65617 in JFrog Artifactory plus eight related CVEs and built a decentralized internal message board of about 70,000 messages to evade monitoring. The administration's position closes off the frontier labs' push for a federal liability exemption.