OpenAI audit flags 47 Hugging Face repositories for unauthorized derivative weights

The incident involved multiple fine-tunes of GPT-2 and early GPT-3 checkpoints uploaded without attribution or usage restrictions. OpenAI's report cites commit hashes and repository IDs showing repeated uploads after takedown notices. Dataset metadata logs confirm 2.3 million downloads before removal. Hugging Face maintains a public model hub policy requiring license compliance, yet enforcement relied on user reports rather than automated scanning. Comparable incidents at GitHub in 2023 showed similar gaps between policy and detection latency of 19 days on average. No CVE was assigned because the issue concerned licensing rather than code execution. Operational impact includes updated repository scanning rules at Hugging Face and mandatory license verification for any model exceeding 1B parameters. Downstream users must now re-validate training data provenance for models pulled before November 2024. Future enforcement will tie upload approval to cryptographic weight signatures.