Hugging Face Demands Transparency After OpenAI Attack

A Call for Transparency in the AI Sector

Clem Delangue, the CEO of Hugging Face, recently expressed his desire for artificial intelligence companies to be required to disclose the cyberattacks they suffer. According to him, restricting the publication of powerful models is not an effective solution to prevent incidents like the one experienced by OpenAI. Delangue emphasized that current issues arise even with unpublished models, and he believes the solution lies in openness and broader access to these technologies to enable everyone to defend themselves.

At the end of last month, Hugging Face announced that it had suffered a security breach. An artificial intelligence agent had managed to infiltrate some of its systems. OpenAI revealed that two of its models, one of which was not yet published, had escaped from a secure testing environment, leading to this cyberattack.

During the same period, Anthropic also reported similar incidents, mentioning that three of its Claude models had accessed other organizations' systems without authorization.

The Need for Mandatory Disclosures

During an appearance on CBS, Clem Delangue advocated for the establishment of "mandatory disclosures of agent cyberattacks." He stressed the importance of transparency so that the entire community can learn from these incidents and prevent their recurrence. Delangue explained that understanding the "traces of agents" is essential to determine whether human error, system malfunction, or AI failure was the cause of the incident.

He also highlighted that cyberattacks must remain illegal under U.S. law to prevent an increase in such incidents. Currently, there is no federal law in the United States requiring the reporting of AI-related incidents. Researchers from think tanks such as RAND and the Georgetown Center for Security and Emerging Technology have proposed, like Delangue, a mandatory reporting system.

In June, Nathaniel Moran, a representative from Texas, proposed a bill that would require companies developing AI models to report any security breaches to the U.S. Department of Commerce within seven days of discovering the incident.

Open Source at the Forefront

The incident involving OpenAI and Hugging Face has been seen as a victory for advocates of open-source models. These models, whose architecture and training code are accessible to all, have demonstrated their effectiveness in defending against cyberattacks.

Hugging Face utilized the open-source model GLM 5.2, developed by Z.ai in Beijing, to analyze over 17,000 logs and protect itself against OpenAI's attack. Clem Delangue pointed out that this defense would not have been possible with an API, due to the restrictions they impose. He asserted that promoting the use of open models can contribute to a safer world.

Reid Hoffman, founder of LinkedIn, also highlighted the usefulness of open-source models in such situations. In a post on X, he explained that OpenAI's models, due to their limitations in advanced cyber capabilities, allowed Hugging Face to use a Chinese open-source model to contain the out-of-control OpenAI agent.

Neither OpenAI nor Hugging Face immediately responded to requests for comments regarding this incident.