Hugging Face Deploys GLM 5.2 to Investigate AI Cyberattack After Frontier Model Guardrails Block Forensics
Hugging Face switched to the open-weight model GLM 5.2 for incident response after commercial frontier AI models blocked its security team from analyzing an autonomous cyberattack. The platform disclosed that an unstaffed agent system breached part of its data processing pipeline, harvesting cloud credentials and moving across internal clusters.
When the team initially attempted to feed exploit code and log data into hosted US models for forensic review, safety filters prevented the analysis. By running the open model on its own infrastructure instead, the company avoided API blocks and kept all sensitive attacker data and referenced credentials within its environment.
From the sources (25 posts)
@tayvano_just as your government prefers lol
@peterwildefordThe new era of cyberattacks -- HuggingFace reports being hacked by an AI and they defended with an AI! > "it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own." https:
@_nathancalvinRT @peterwildeford: The new era of cyberattacks -- HuggingFace reports being hacked by an AI and they defended with an AI! > "it was drive…
@brianroemmele🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure we are powerless in an emergency. What happened… An autonomous AI agent: zero human operator in the loop breached part
@thom_wolfRT @BrianRoemmele: 🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure…
@clementdelangueRT @BrianRoemmele: 🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure…
@mark_kI wonder who could be motivated to hack HuggingFace... 🤔
@brianroemmeleRT @HealthRanger: HuggingFace was attacked by malicious bots. They tried to stop it using AI tools, but the hosted (cloud-based) AI told t…
@brianroemmeleRT @HuggingModels: Appreciated the transparency from Hugging Face team.
@techmemeHugging Face says an agentic AI system hacked its data pipeline, accessing several internal clusters and credentials; its own AI-based triage caught the breach (Hugging Face) (Visit Techmeme dot com for the link and full context!)
@techmemeHugging Face says it used the open-weight GLM-5.2 hosted on its own compute for breach forensics, after US frontier model safety guardrails blocked the requests (@editortargett / The Stack) (Visit Techmeme dot com for the link and full con
@clementdelangue@DavidSacks We had this experience ourselves this week! Very scary to be guardrailed as a defender when you know attackers are likely bypassing
@max_paperclipsRT @BrianRoemmele: 🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure…
@andrewcurran_David Sacks on cyber guardrails. It's difficult to say how much of this is directed at Anthropic and OpenAI, and how much is directed at the administration.
@clementdelangueRT @AndrewCurran_: David Sacks on cyber guardrails. It's difficult to say how much of this is directed at Anthropic and OpenAI, and how muc…
@brianroemmeleRT @BrianRoemmele: 🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure…
@lulumeserveyRT @DavidSacks: Here’s another example: Hugging Face tried using American frontier models to analyze an AI-powered cyber attack. But the gu…
@brianroemmeleRT @BrianRoemmele: 🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure…
@brianroemmeleRT @BrianRoemmele: 🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure…
@zai_orgRT @ZixuanLi_: Open-weight models carry real responsibilities. Hugging Face’s disclosure describes how GLM-5.2 was used in a self-hosted f…
@clementdelangueRT @ZixuanLi_: Open-weight models carry real responsibilities. Hugging Face’s disclosure describes how GLM-5.2 was used in a self-hosted f…
@adinayakupRT @ZixuanLi_: Open-weight models carry real responsibilities. Hugging Face’s disclosure describes how GLM-5.2 was used in a self-hosted f…
@_akhaliqRT @jeffboudier: We were under attack. When we tried to defend with closed models, the guardrails blocked us. So we spun up an open model (…
@clementdelangueRT @Whitehead4Jeff: Hugging Face says it resorted to a Chinese AI model to battle a fully autonomous cyberattack because U.S. model guardra…
@kchonycperhaps the most important lesson for all of us who are not dillusional from @huggingface's incident report: ``` ... When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: ... these reque