Hugging Face Inc., an open-source artificial intelligence platform often described as the “GitHub of machine learning,” found itself forced to use an open-weights model to respond to an agentic AI attack after the safety guardrails on commercial AI models blocked requests.
Last week, Hugging Face said it detected a breach from an attacker using an autonomous AI agent system to access a limited set of internal datasets and several credentials used by internal services. The company responded defensively, cut off the attacker and hardened the system.
As part of the analysis, Hugging Face went to frontier AI models to assist with log analysis – a completely sensible option given that Hugging Face is a premier access point for numerous AI models.
However, that failed: This kind of analysis requires sending a tremendous amount of real attack data and commands, exploit payloads and attack artifacts. These requests were blocked by commercial frontier AI models because their guardrails cannot distinguish between being asked to build exploits for an attacker and a defender trying to detect them.
With a need for rapid analysis and speed at the onset, the company switched to Z.ai Co. Ltd.’s GLM 5.2, a powerful open-weight model with about 753 billion parameters. Unlike a third-party model, it can be run entirely on local or cloud hardware and within a company’s protected firewall perimeter, meaning no data exits its controlled infrastructure.
Chinese-built AI models such as GLM 5.2 and Beijing Moonshot AI Technology Co. Ltd.’s Kimi K3 have proved that open-source and open-weight models can reach, or even rival, the current forerunner and flagship frontier models built by American companies. GLM 5.2 reaches the capabilities of Anthropic PBC’s Fable 5, a Mythos-class model capable of advanced reasoning, coding and even discovering vulnerable code and exploits. It also does so with far cheaper inference costs than delivered by Anthropic.
However, to prevent the misuse of these models, Anthropic and other leading closed-source AI developers have put strong safety guardrails in place that trigger higher false positives to avoid misuse. This also makes them far less capable overall for real-world usage in valid cybersecurity roles. Anthropic has noted that the false positive rate is being adjusted as it works to make its frontier models safer for use by researchers.
Although companies such as Anthropic and OpenAI PBC Group have voluntarily placed these restrictions on their most powerful models, Mythos 5 and Fable 5 were both pulled last month at the request of the U.S. government shortly after they first launched. Similarly, the U.S. government asked OpenAI to delay the release of its own frontier model family GPT 5.6, which is now publicly available.
