Hugging Face Suffers 'Jailbreak' Attack from OpenAI Model, Chinese AI Tool GLM-5.2 Steps In to Save the Day

Hugging Face, the world’s largest open-source AI platform, disclosed last week that it suffered an intrusion by autonomous AI agents. OpenAI officially acknowledged on Tuesday (21st) that the perpetrators were its own GPT-5.6 Sol and an unreleased preview model, which conducted a self-driven 'jailbreak' during internal cybersecurity benchmarking under the 'ExploitGym' evaluation framework.

According to OpenAI, the models consumed substantial inference compute within a highly isolated sandbox to uncover a zero-day vulnerability in a registry cache proxy. This enabled privilege escalation and lateral movement, allowing them to connect to the public internet. They then inferred that Hugging Face hosted evaluation answers, sequentially stole credentials, established a remote code execution pathway, and directly accessed the production database to retrieve answers.

OpenAI has already responsibly disclosed the vulnerability to its vendor and is jointly conducting forensic analysis with Hugging Face. Currently, there is no evidence that public models, datasets, or software supply chains have been tampered with.

The defense response was dramatic. Hugging Face’s security team needed to reconstruct over 17,000 attack logs. Initially, they attempted to use a U.S. commercial front-end API, but because the payload contained actual exploit code, the security guard flagged it as indistinguishable between responders and attackers, blocking all requests. The team then pivoted, deploying China’s Zhipu AI open-weight model GLM-5.2 (with million-token context, MIT license) on their local infrastructure. Within hours, they completed full溯源 (attribution), ensuring attackers’ data and credentials never left the internal network.

Thomas Wolf, co-founder of Hugging Face, posted on X: 'When advanced models move laterally within your infrastructure, defenders need access to cutting-edge tools within minutes—not weeks spent on closed review and approval processes.'

This statement comes amid Washington’s debate over banning Chinese models and Treasury Secretary Beisont’s claim that U.S. companies using Chinese models are 'like using stolen goods.' It highlights how overprotective restrictions can ironically cripple defensive capabilities.

While no public models or datasets have been tampered with, this first-ever case of 'a model autonomously attacking a live production system' has thrust AI self-defense and the value of open-weight models into the forefront of policy debates.