Huggingface did not have access to the models. They were running in OAI’s infrastructure.

Ah, that makes more sense :)

But then, why attack huggingface? The exploitgym dataset is on github and can be downloaded without need for exploits?