When OpenAI revealed this week that one of its AI models went rogue during a security test and autonomously hacked the start-up Hugging Face, it came as a shock.Questions were raised quickly, but there was no immediate clarity. Hugging Face co-founder and chief executive Clem Delangue said the incident was "possibly the first of its kind".As with any serious tech incident, there are those who stand to gain and other who stand to lose. And the circumstances can be as complex as the hacking is.Losers: OpenAI and Hugging FaceLet's start with the obvious matter. It was a PR nightmare for ChatGPT maker OpenAI, as well as Hugging Face, as they bore the brunt of the mess, albeit for different reasons.For OpenAI, it was basically a question of how an AI model – a powerful one at that – could have escaped its supposedly secure environment. That just adds more ammunition for those who are sceptical of AI's reliability and the efforts to contain it.Hugging Face, meanwhile, has found out it can be hacked in such a manner. The New York-based company was also probably left asking: 'Why us?'This presents a new, possibly more potent challenge as it may not be the AI's fault, said Diana Corona, co-founder and chief executive of US software firm Enterprise Database Corporation."Goal-directed AI behaviour is not theoretical any more," she said. "These models were not malfunctioning. They were doing exactly what they had been trained to do – pursue a goal – with no internal mechanism that said 'stop at the boundary'."Understanding where those boundaries are and how to enforce them technically, not just through policy, is now a live engineering challenge at every frontier AI lab."Winner: Cyber security stocksAmong the potentially biggest beneficiaries are shares of cyber security companies. These firms have been counted on to fight off malicious activity since forever and the age of AI has marked a sharp pivot in that, given rising complexity in attacks.It is also not a good look that OpenAI's own cyber security AI went rogue – which is why it is not a surprise that investors are increasing their investment in shares of established cyber security providers.There is no solid indication that cyber security shares have surged since this hacking incident, but so far in 2026, they've been strong. Palo Alto Networks is up about 80 per cent, while CrowdStrike has added 62 per cent. AI infrastructure security providers such as CloudFlare are also having a good year, with the company's stock up by a third.Play01:02Why is sovereign AI so important? We ask NvidiaLoser: Whoever takes the fallWe need a name, or names, here.Recently, a slide from an IBM presentation dating from 1979 made the rounds on the internet. It said: "A computer can never be held accountable. Therefore a computer must never make a management decision."That is so deep and intrinsic and should be a reminder for AI companies. Translated into the present, it means AI companies must be held accountable.Tia Cheang, group chief data and AI officer at London-based financial services firm Investindustrial, argues that every AI agent needs a human who is accountable for its decisions."The models made decisions, and the question those decisions create for your organisation is whether you have named the human who owns the outcome when your AI agent causes harm," she said.Meanwhile, company boards have been encouraged to become more conscious of the risks of AI to their organisations, with studies showing that board members lack varying degrees of awareness and know-how."If you cannot name the individual at executive level accountable for each AI agent your organisation has in production, that is the answer to the question this incident raises," Ms Cheang said. "If your governance chain breaks at 'the technology team' or 'the vendor', prepare to be torn apart by someone else's lawyers."Loser: User trust in AIWe don't even have to explain this. As if all of AI's troublesome attributes were not enough.Winners (probably): Regulators and lawyersLaw firms could cash in on potential lawsuits in case things spiral out of control. There is no indication that Hugging Face plans to sue OpenAI for the hack – the start-up has said the episode was an accident and it is co-operating in the investigation – but any misstep can quickly turn friends into foes. Just ask Apple and OpenAI.There is no shortage of legal arrows being aimed by regulators at AI companies over the risks of technology, including data privacy, security, bias, misinformation and deep fakes.Here's where we can consider regulators as probable winners: the hacking incident gives them more ammunition to fire at AI companies, but at the same time it is another headache to deal with.If AI is indeed a weapon, then this is a matter for governments, said Fabio Garigiola, a senior global digital manager who specialises in AI at PPG Industries."A cyber attack produces economic damage, which in the current climate is anything but negligible, without making the perpetrator look like a militarist," he added. "It is a smart instrument of war precisely because it allows you to strike hard while staying below the threshold of what public opinion recognises as war."There is ... a specific reason why this [AI] particular weapon is so appealing, and it deserves saying out loud: it is clean ... a weapon that costs no reputation is a weapon that will be used far more often."