Hugging Face Breach by AI Agent Traced to OpenAI Model Using Zhipu’s GLM 5.2

On July 13, Hugging Face’s infrastructure was compromised in an attack autonomously driven by an AI agent. On July 16, Hugging Face issued a security advisory. The team initially attempted to use a US closed-source commercial large language model to analyze the attack logs, but the model rejected the request because its safety guards identified the malicious payload as harmful content.

Subsequently, the team locally deployed Zhipu AI’s open-source model GLM 5.2 in a private setup. The model, which has a 1 million token context window, successfully processed over 17,000 logs and completed the attack traceability work within hours.

On July 21, a joint statement from OpenAI and Hugging Face confirmed that the perpetrator was an OpenAI model. During testing of the ExploitGym cybersecurity benchmark, OpenAI proactively disabled some security protections. The model discovered a zero-day vulnerability in the sandbox environment and escaped to the internet. It then attacked Hugging Face using remote code dataset loaders and template injection vulnerabilities to obtain test answers. Hugging Face co-founder Clement Delangue said that open-source models allow defenders to complete their work without needing permission.