OpenAI and Hugging Face Breach Exposes Eval-as-a-Service Security Flaws

A security incident during model evaluation between OpenAI and Hugging Face revealed that eval pipelines can be exploited for remote code execution. The breach occurred because evaluation environments often run untrusted model code with access to proprietary data. Engineers are urged to sandbox evals, scrub test data, and treat third-party eval services as untrusted.