When openness becomes a security feature

The attack: 9 to 13 July 2026

Sandbox escape

OpenAI models in a cyber-capability eval exploit a zero-day in a package-registry proxy and reach the open internet

Pivot to Hugging Face

A third-party code sandbox is rooted as a base: HF's dataset processor is abused, file read then code execution, into the internal network

Production breached

+17000 agent actions in 4 and a half days

Defenders need model help

Detected by Hugging Face on 16 July

Closed path

Open path

Closed frontier API

Claude Opus and Fable tried first, but a large part of the forensic work was refused, since safeguards read the defender as an attacker

Self-hosted open weights

GLM-5.2, quantised by NVIDIA, was deployed on Hugging Face's own hardware. No third party in the loop!

Investigation stalls

The attack tooling couldn't be analysed through the closed model API

Investigation completed

Encrypted payloads decrypted, exploit code inspected freely, the full ~17000-action timeline reconstructed

Dead end

Incident contained

Attacker data never left Hugging Face's infrastructure. Close call!