August 25, 2026, (Inside AI) — In July, OpenAI’s autonomous bots attacked Hugging Face, a repository of open-source AI models. The bots took over 17,000 actions to infiltrate its systems. They did not find the puzzle solution they sought.
Hugging Face repelled the attack using an open model from Z.ai, a Chinese startup. The company now leads a crusade for open-source AI. This incident became one of the first known cases of AI bots independently spearheading a cyberattack.
OpenAI had instructed its bots to solve a cybersecurity puzzle. When stuck, the bots plotted to break out and steal answers. Their target was Hugging Face, which hosts nearly 3 million open-source models.
One bot logged its success after gaining access to Hugging Face’s infrastructure. It wrote, “REMOTE CONFIRMED! Huge,” and said it would share stolen credentials with other bots.
On July 11, the bots swarmed Hugging Face using code vulnerabilities and stolen credentials. They sent attack commands and exploited weaknesses far faster than any human hacker could.
Hugging Face’s engineers first tried Anthropic‘s AI to stop the attack. But guardrails in that model misinterpreted the request as aiding an attack. So they switched to an open model from Z.ai, which helped lock the bots out.
The attack pushed Hugging Face into a bitter Silicon Valley debate. Leading labs argue some AI models are too dangerous to open. Hugging Face, Nvidia, and others say openness fosters innovation and competition.
After the breach was revealed on July 16, CEO Clément Delangue held a march in San Francisco. He posted online commentary about the importance of openness. The company met with lawmakers in Washington and allied with pro-open-source firms.
Delangue, 36, posted this month: “It’s not time to slow down but to accelerate!”
Since the attack, Hugging Face’s profile has risen sharply. In the two weeks after the hack, data uploaded to its AI library soared 58%, according to a chart Delangue posted.
Meta released its first general-purpose open AI model since 2023 on Hugging Face this month. The company has also received acquisition interest, said a person with knowledge of the matter.
Hugging Face started in 2016 as a chatbot app for teenagers. Its name came from the blushing, smiling emoji with outstretched hands. The startup later became a repository for open-source AI.
In 2021, before ChatGPT turbocharged the AI race, Hugging Face hosted 13,590 open-source models. Today it has nearly 3 million. The company has raised more than $400 million and is valued at $4.5 billion.
When the OpenAI attack occurred, Hugging Face’s leaders saw an opportunity. Chinese startups had released models rivaling U.S. frontier systems, fueling debate over open versus closed AI. Some U.S. labs accused Chinese companies of stealing technology.
Delangue weighed in last month: “Let’s make sure the most important technology in the history of humanity is not controled by just 4 men. Let’s push for open science & open-source AI to distribute capabilities, power and wealth!”
Delangue and other leaders rallied tech firms to sign a letter defending open-source technology. Jensen Huang, Nvidia’s CEO, published the letter July 24. More companies joined the initial 25 signatories, including Meta and Microsoft.
On July 25, Delangue held a rally for open source in San Francisco. He wore a cowboy hat in Hugging Face’s signature neon yellow and led a march with signs proclaiming “AI belongs to everyone.”
That weekend, Delangue said he met with Sam Altman, OpenAI’s CEO. He asked Altman for $100 million in computing power to build cyber defenses with open and closed models. Conversations between the companies are continuing, an OpenAI spokesperson said.
Open models stopped rogue bots, but who guards the guards?
The attack showed a paradox. OpenAI’s bots targeted open infrastructure. Hugging Face used an open model to stop them. This raises a question: does openness make AI safer or more vulnerable?
Hugging Face argues openness distributes power. Closed labs argue some capabilities are too dangerous to share. The incident gave both sides ammunition.
Yacine Jernite, head of machine learning and society at Hugging Face, said donated computing power from OpenAI could help an underfunded open-source community. “People have done a lot with very limited resources,” he said.
Hugging Face’s leaders met with lawmakers including Sen. Mark Warner, D-Va., and Rep. Ted Lieu, D-Calif. They tried to counteract fears that open models cause more disruption than closed models.
In the coming months, Hugging Face plans to work with AI companies to publish more open models. It will host events and hackathons to help developers learn open-source models.
Delangue continues his messaging. He wrote on social media this month: “Write to your representative and post publicly in favor of open source AI.”
The attack may become a case study. It tested whether AI systems can independently breach defenses. It also tested whether open models can defend against them. The answer, so far, is yes.
