V2EX Keyword Hot Topics
This is Why We Need Open-Source AI Models
On July 16, Hugging Face, the world's largest AI model platform, published an article announcing that their servers had been breached by a fully autonomous AI Agent, with almost no human involvement throughout the process. The attack began with a malicious dataset; the Agent chained two code execution vulnerabilities in the data processing system to gain node-level permissions, stole cloud and cluster credentials, and moved laterally across multiple internal clusters. It executed thousands of automated operations, ran across a large number of short-lived sandboxes, and even established a self-migrating C2 control system. Hugging Face ultimately recorded over 17,000 attack events. But something even more absurd happened during the investigation. Hugging Face initially tried to analyze logs using the APIs of US closed-source leading models @ChatGPTapp and @claudeai, but the real attack commands, vulnerability payloads and C2 data triggered their safety guardrails, and the models simply refused to work. In the end, they could only run the open-source model GLM 5.2 from China's @Zai_org on their own servers. GLM 5.2 analyzed more than 17,000 records within hours, reconstructed the attack timeline, located the stolen credentials, and distinguished real attacks from decoy behavior. If there were no top-tier open-source models like GLM 5.2 in the world, Hugging Face would have absolutely no ability to stop this breach. Because human response speed is far slower than that of Agents, even a security team of hundreds of people may be no match for several attack Agents running simultaneously. The most interesting part of this incident is that the attacker had no safety restrictions, while the defenders were blocked by safety guardrails. When both attack and defense become Agent-driven, what really matters is no longer just model capability. Whoever can run, audit and control models on their own holds the security initiative in the era of machine-speed operations. This is a bit like nuclear weapons — mutual deterrence is the only way to ensure world stability. Original post: https://huggingface.co/blog/security-incident-july-2026 Original tweet: https://x.com/MaxForAI/status/2079350994056737232?s=20 ------------- Only when everyone is armed can order be maintained. The storm is coming. Can you mobilize the private army of hired A/O lords when an emergency hits?