> Sure but the problem in the HuggingFace incident is that they were not.

Of course they were, even if indirectly.

You should go read the incident reports.

They were literally doing exploit gym.

	▲	heaney-555 15 minutes ago \| parent [-]
		Yes, which asks them to find exploits in specific software on the device. But instead of actually doing so, they discovered and exploited a 0-day in the package manager to gain internet access, then hacked HuggingFace to steal the ExploitGym answers! That is TEXTBOOK misalignment. It's as if a student hacked their professor's PC to find the answers to a test, and your response is "well the professor told the student to pass the test, so they just did what they were told!".