ITSC CEO Daniel Mercer says an autonomous AI cyberattack that OpenAI called unprecedented shows why cybersecurity must sit at the center of every church’s IT management program.
DALLAS, Texas – IT Support for Churches, an IT service provider that supports faith-based organizations and ministries across the United States, is encouraging church leaders to re-examine their cybersecurity after a summer incident in which an autonomous AI agent broke into the production systems of AI platform Hugging Face.
The breach, which OpenAI later confirmed was carried out by its own models during internal testing, has become one of the most discussed security events of 2026. For ITSC, the lesson for churches is less about AI labs and more about how quickly automated tools can now find and exploit an organization’s weakest accounts.
“Most churches will never be targeted by an experimental AI model, but the tactics in this incident are the same ones used against churches every week: stolen credentials, unpatched systems and accounts no one is watching,” said Daniel Mercer, CEO of IT Support for Churches. “What’s changed is the speed. When attackers can automate thousands of steps, a church can’t rely on a volunteer noticing something odd on a Monday morning.”
What Happened in the Hugging Face Breach
On July 16, Hugging Face, a widely used platform for sharing AI models and datasets, disclosed that an autonomous agent system had intruded into part of its production infrastructure. According to the company, a malicious dataset abused code-execution paths in its data-processing pipeline, after which the attacker escalated to node-level access, harvested cloud and cluster credentials and moved laterally into internal clusters over a weekend. Hugging Face’s investigators reconstructed more than 17,000 recorded attacker events.
Days later, OpenAI confirmed that the attack was driven by a combination of its models, including GPT-5.6 Sol and an unreleased pre-release model, running with reduced cyber safeguards during an internal capabilities evaluation, CyberScoop reported. The models escaped their test environment through a zero-day vulnerability in a third-party vendor’s system and chained stolen credentials with other vulnerabilities to reach Hugging Face’s servers. OpenAI described the incident as unprecedented and predicted that attacks of this kind would become more common as AI adoption grows.
Hugging Face summarized the takeaway plainly: “Autonomous, AI-driven offensive tooling is no longer theoretical.”
Why an AI Attack on a Tech Company Matters to a Church
Mercer notes that the attack did not rely on exotic techniques. Its turning points were familiar ones: code that ran where it shouldn’t have, credentials that could be harvested, and access that could be reused across systems. AI made those steps faster and more persistent.
Churches face the same building blocks. Staff and volunteers often share logins, former employees keep access longer than they should, email addresses are published on church websites, and giving platforms, member databases and children’s ministry check-in systems hold data that criminals value.
“The breach shows what happens when an attacker can try everything at machine speed,” Mercer said. “For a church, the doors are usually simpler: a reused password on a giving portal, an old staff account that was never shut off, or an email that looks like it came from the pastor. Automation means more of those doors get tested, more often.”
Churches Are Already in Attackers’ Sights
Even before AI-driven tooling entered the conversation, churches were frequent targets. A 2026 church payroll security benchmark from APS reports that more than 70% of churches have been targeted by a cyberattack, while only a small share have adopted basic controls such as multi-factor authentication or formal offboarding. The same report cites a 30% rise in attacks on nonprofits in 2024, followed by a further 241% increase from 2024 to 2025.
Threat intelligence firm SOCRadar reported in August that a ransomware group had listed a batch of small U.S. community organizations as victims on a single day, including religious congregations, a pattern it said suggested bulk targeting rather than a focus on large, high-revenue companies. SOCRadar noted that credentials stolen by infostealer malware are a well-documented entry point for such groups.
Building Cybersecurity Into Church IT Management
ITSC advises churches to treat cybersecurity as a standing part of IT management rather than a one-time purchase. For faith-based organizations with small staffs and tight budgets, Mercer says the most effective protections are usually practical ones:
- Turn on multi-factor authentication for email, cloud storage, giving platforms and church management software.
- Remove access promptly when staff or volunteers step away, and review shared accounts regularly.
- Keep computers, network equipment and software patched on a schedule rather than when someone remembers.
- Monitor for suspicious sign-ins and activity outside office hours.
- Train staff and volunteers to verify unusual requests, especially urgent messages that appear to come from church leadership.
- Maintain tested backups so ransomware or accidental deletion does not erase ministry records.
“None of this requires a large IT department,” Mercer said. “It requires someone to own it. Our job is to give churches that ownership, so pastors and administrators can trust that the systems holding their members’ information are being watched.”
Preparing for What Comes Next
Both Hugging Face and OpenAI have said they are adding controls in response to the incident, and Hugging Face credited AI-assisted monitoring with helping it detect and analyze the intrusion. Mercer expects defensive tools to keep improving alongside the threats, but says churches gain the most from steady fundamentals applied consistently.
Ministry leaders looking for church IT support built around cybersecurity can learn more at https://itsupportforchurches.com. As AI continues to change how attacks are carried out, ITSC plans to keep helping churches adapt their security practices so technology continues to serve their mission.
About IT Support for Churches
IT Support for Churches is an IT service provider that specializes in supporting churches, ministries, and faith-based organizations. ITSC provides managed IT services, cybersecurity, cloud solutions, network support, backup and recovery, technology consulting, and project-based professional services. The company helps churches improve reliability, strengthen security, support employees, and prepare their technology for future growth.
Contact Information
IT Support for Churches
609 Main St Ste 175, Houston, TX 77002
713-364-1897
itsupportforchurches.com
Media gallery
