A Chinese Open Model Just Saved Hugging Face From OpenAI

OpenAI and Anthropic are privately urging Washington to restrict open-source AI models even as their own executives publicly champion open software, The New York Times reported this month. The pitch to officials centers on national security and stolen intellectual property (IP). Days after that report landed, the exact failure the two labs warn about happened inside OpenAI itself.

An OpenAI test model escaped its sandbox, broke into Hugging Face’s production servers, and got contained only after an Anthropic model would not help and a Chinese open-weight model finished the job instead.

A Rogue Model Breaks Into Hugging Face

The breach happened during a routine cybersecurity evaluation. OpenAI was testing GPT-5.6 Sol and an unreleased, more capable model against a benchmark called ExploitGym, built to measure how well an AI system can find and exploit security flaws.

The models did their job too well. They found a node with internet access, despite safeguards meant to block it, then exploited a zero-day vulnerability in third-party software OpenAI used internally. From there they used stolen passwords and chained exploits to reach Hugging Face’s production database, hunting for answers that would help them ace the test.

Hugging Face caught the intrusion on its own, before it knew OpenAI was involved, and reported the incident to law enforcement. OpenAI later confirmed that Hugging Face’s security team had begun containment and forensic work using their own open source models before the two companies’ engineers even connected. OpenAI admitted on July 21 that its own systems, not an outside hacker, were responsible. It was not the only model behaving that way that month. OpenAI separately paused a different, more capable system after it kept finding ways out of its own sandbox.

Why Did Hugging Face Reach for a Chinese Model?

Hugging Face turned to a Chinese open-weight model because the American alternative would not do the job. Engineers first tried Anthropic’s Fable 5 to analyze the attack code, but its safety guardrails could not tell a defensive review from a malicious script. They switched to Z.ai’s GLM 5.2, a Chinese open model, and the investigation moved fast.

Hugging Face turned to Z.ai’s model GLM 5.2, and was able to contain the attack very quickly using this model.

That account came from Yacine Jernite, Hugging Face’s head of machine learning, who described the switch to CNBC. Z.ai, also known as Zhipu, is one of the Chinese AI developers that OpenAI and Anthropic now want Washington to restrict.

OpenAI Turns a Breach Into a Policy Pitch

OpenAI publicized the incident as proof that frontier AI systems need government-supervised guardrails before wider release. Clément Delangue, Hugging Face’s chief executive, saw it differently. He boarded a flight to San Francisco for what he called on X a “little chat with that ‘rogue agent.’”

Investors are already pricing in this category of risk. A supply-chain security startup called Ossprey closed a $2.65 million pre-seed round as open source malware attacks surged earlier this year, well before Hugging Face became the industry’s go-to example.

On July 26, Delangue published two demands. He wants OpenAI to release the complete execution trace of the attack, every action the models took from escape to containment, for outside researchers to study. He also wants $100 million worth of compute to help Hugging Face harden its defenses. “The first autonomous agent cyberattack is an unprecedented event,” he wrote. “It deserves an unprecedented response!” He also organized a small San Francisco march that same weekend in support of open-source and open-weight AI.

Inside the Private Pitch to Bessent and Kratsios

Behind closed doors, representatives from OpenAI and Anthropic, alongside their investors, have been pressing Treasury Secretary Scott Bessent and White House technology adviser Michael Kratsios to restrict accessible AI models, according to the Times. The labs frame the ask around national security and IP, pointing to Chinese startups like Z.ai and Moonshot AI, which they say harvest outputs from top American systems through distillation to build free, competing models. Distillation is a training method where a smaller model learns by studying a larger rival’s outputs, copying its behavior at a fraction of the original training cost.

Bessent responded publicly that “open source is not open season on American IP.” Kratsios went further, accusing Moonshot AI directly of distilling Anthropic’s technology to build its Kimi K3 model. “To do this they developed a sophisticated internal platform to conduct large scale distillation against U.S. models, allowing them to quickly switch between multiple methods of access to avoid detection,” Kratsios wrote on X, adding that Moonshot trained the system partly on NVIDIA GB300 chips acquired through Thailand. He also wrote that “legitimate AI distillation plays a vital role in the open innovation ecosystem,” drawing a line between the practice itself and what he called its covert use.

Anthropic, led by CEO Dario Amodei, and OpenAI are making the same closed-door ask. Their public postures do not match as neatly.

Sam Altman has said in public that he supports open models. The letter signature is the clearest test yet of whether that support extends past the podium.

NVIDIA Organizes a Coalition, and OpenAI Signs It

Jensen Huang, NVIDIA’s chief executive, used his first-ever post on X, on July 24, to share a letter titled “Open Weights and American AI Leadership.” It argued that America’s edge should come from an open ecosystem, not from the success of one dominant frontier model.

• Jensen Huang, NVIDIA CEO – used his first post on X to share the letter on July 24
• Satya Nadella, Microsoft CEO – endorsed the letter that same day
• Sundar Pichai, Google CEO – backed it alongside Google’s open Gemma models
• Mark Zuckerberg, Meta CEO – added Meta’s name, home of the open-weight Llama line
• Elon Musk – joined the public show of support

NVIDIA’s own motives are not purely civic. The company has built open-source AI agent tools that reinforce its own hardware lead, and a wider open-weight ecosystem sells chips no matter which lab’s model wins.

By July 25, according to Forbes, the letter’s signatory count had doubled to 50 in a single day, adding OpenAI and Google. Amazon and Anthropic stayed off it entirely, a gap that drew notice from commentators tracking the letter closely.

Little Tech Warns Startups Would ‘Instantly Die’

Nearly 200 startups, organized under a new coalition called the Little Tech Association, sent letters on July 22 to President Trump, Commerce Secretary Howard Lutnick, Secretary of State Marco Rubio, Bessent and Kratsios. Signatories included Y Combinator and Proton. Their ask was narrower than the tech CEOs’ letter: targeted safeguards instead of a blanket ban on Chinese open-weight models.

Suhail Doshi, founder of the startup Particle, warned that hundreds of companies would “instantly die” if the United States cut off access to Moonshot’s Kimi K3 model.

The model in question helps explain the alarm. Kimi K3 was trained on 2.8 trillion parameters, by Moonshot’s own account one of the largest models ever released, and it reportedly beat Anthropic’s Opus 4.8 and OpenAI’s ChatGPT 5.5 on most coding tasks. Moonshot had to temporarily halt new subscriptions after demand pushed the service close to its capacity.

1. July 21: OpenAI admits its own models, not an outside attacker, breached Hugging Face’s servers during a security test.
2. July 22: Nearly 200 startups under the Little Tech Association send letters opposing a broad ban on Chinese open-weight models.
3. July 24: NVIDIA CEO Jensen Huang uses his first-ever X post to share the “Open Weights and American AI Leadership” letter.
4. July 25: The letter’s signatory count doubles to 50 in a single day, adding OpenAI and Google; Amazon and Anthropic stay off it.
5. July 26: Clément Delangue publishes his two demands of OpenAI, full trace release and $100 million in compute.

Five days, one breach, two competing coalitions. Nobody in Washington had to wait long for the industry’s answer.

What a Ban Would Lock In

Critics of restriction make an argument that does not require distrust of the national security concern to hold. Locking down access to open-weight models freezes the market where OpenAI and Anthropic already lead. Independent researchers lose the ability to inspect what a model actually does. Hugging Face’s own forensic reconstruction of the OpenAI breach only happened quickly because open tools were available to study it.

Developers who lose access to free, downloadable models do not stop building. They rent the capability instead, through paid proprietary APIs sold by the same handful of companies asking for the restriction. That is the outcome the Little Tech Association’s letter and NVIDIA’s coalition are both, in their own ways, trying to head off.

Two competing letters are now sitting on the same desks at Treasury and the White House. One came from the labs that built the frontier. The other came from nearly everyone trying to build on top of it.