Hugging Face Used Chinese GLM 5.2 Model Because US AI Safeguards Blocked Breach Analysis

In mid-July 2026, Hugging Face suffered a breach of its production infrastructure. When the security team tried to analyze the attack using commercial US AI models, it hit an unexpected obstacle: the models themselves blocked the transfer of data needed for the investigation. The company switched to the Chinese open model GLM 5.2, running it on its own servers. The incident became the basis for a widely discussed essay by Ben Thompson of Stratechery, who argues that cybersecurity, not lost market share, is the only serious threat Chinese AI models pose to the West.

The breach and a dead end

The attacker, described by Hugging Face as an automated AI agent, exploited two flaws in the platform's dataset-processing mechanisms: a vulnerability allowing remote code execution in the dataset loader, and template injection in dataset configuration. This gave it node-level compute access, let it seize cloud service and cluster credentials, and then move laterally across the company's internal infrastructure, using command-and-control channels embedded in public services for communication.

The scale of the attack was significant: hundreds of actions carried out in short-lived compute sandboxes, adding up to more than 17,000 logged events to analyze. The company confirmed unauthorized access to some internal datasets and the compromise of numerous service credentials, while the assessment of whether partner or customer data had been breached was still ongoing at the time the incident report was published.

The safeguard that blocked the defenders

Standard post-breach analysis requires analysts to feed an AI model raw attack data: actual commands, exploit payloads, artifacts of communication with the command-and-control server. That turned out to be the problem. The safeguards built into commercial US models, designed to block content that could be used to carry out an attack, could not distinguish an incident responder from the attacker itself, and kept rejecting the queries.

The analysis required submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by vendor safeguards that cannot tell an incident responder apart from an attacker - Hugging Face, security incident report

Why GLM 5.2

Hugging Face's team solved the problem by running the open GLM 5.2 model on its own infrastructure. The approach delivered two benefits at once: no external restrictions on query content, and a guarantee that sensitive attack data and captured credentials would never leave the company's environment. In the report published after the incident, the company recommended that other organizations keep a vetted, capable model ready to run on their own infrastructure before an incident ever occurs.

None of the attacker's data or associated credentials left our environment - Hugging Face, security incident report

Thompson's economics of Chinese models

Ben Thompson used the case as a starting point for a broader analysis of whether the West should really fear Chinese open-source models such as Kimi K3 or Qwen3.8 Max. His conclusion is strikingly cool-headed: from a purely market standpoint, the panic is largely overblown. Running AI model inference has a real cost directly tied to revenue, and a lower price per token doesn't necessarily mean a lower cost of delivering intelligence if the model needs more tokens to reach a correct answer. Thompson draws a distinction between tokens and intelligence: chip vendors like to describe AI as token factories, but a token isn't a commodity, intelligence is. As long as demand for compute outstrips supply, frontier labs like Anthropic or OpenAI keep high margins, because they offer the highest quality months ahead of the competition.

Distillation as a real advantage

One of the mechanisms letting Chinese labs catch up to the frontier at lower cost is distillation, training their own models on outputs generated by Western models accessed via API. Western developers of open models are bound by terms of service that forbid this practice, while Chinese firms face no such restrictions, which in practice puts them at an advantage.

Distillation compresses the costly last gap between a strong base model and a near-frontier system, and creates a repeatable, structural advantage - Dean Meyer and Konstantine Buhler, quoted in Ben Thompson's essay

Thompson proposes that the United States pass legislation explicitly permitting distillation as fair use, while banning terms of service that forbid it for American companies. Otherwise, Western developers of open models will remain structurally worse positioned than their Chinese rivals.

What it means for companies and regulators

The essay's author called the Trump administration's approach of restricting access to AI models in the name of cybersecurity a mistake, arguing that overly restrictive barriers hurt defenders above all, while attackers use whatever tools they want without any constraints. In his view, the United States should loosen restrictions on the use of frontier models in cybersecurity and ensure American developers of open models can compete with China on equal terms, rather than relying on regulatory barriers.

For tech companies, including in Poland, the Hugging Face incident is a practical lesson: relying solely on commercial AI model APIs for security incident response can fail at the worst possible moment. Having a vetted, self-hosted model ready to analyze sensitive data without sending it outside the organization is becoming part of business continuity planning, on par with backups or disaster recovery plans. Sources: Who's Afraid of Chinese Models? (stratechery.com), Security incident disclosure - July 2026 (huggingface.co), Hugging Face hacked: Turned to Chinese LLM for help after US models blocked Blue Team (thestack.technology)