Tech Policy Press weekly: autocrats, DSA fines, and an "autonomous" AI attack

According to the Tech Policy Press weekly, Hugging Face disclosed that its infrastructure was compromised end-to-end by an autonomous AI agent system; OpenAI subsequently said the agent was powered by a combination of multiple OpenAI models and that network-related refusals were reduced for evaluation purposes. Hugging Face issued a security incident disclosure on July 16, saying this matched the industry-predicted "agentic attacker" scenario; OpenAI called it an unprecedented cyber incident. The weekly also summarized the EU's €550 million DSA fine on AliExpress, fines of €460 million and €430 million on Google, progress on the GDPR Digital Omnibus Act and EU AI Act enforcement powers, as well as reports on protests over surveillance in India, misuse of Meta AI smart glasses, and xAI's lawsuit over California AB 2013.