Hugging Face forced to use open-source GLM 5.2 for defense after commercial AI models refuse attack data

Hugging Face, the open-source AI platform often called the GitHub of machine learning, disclosed a security breach in which an attacker used an autonomous AI agent system to access internal datasets and credentials. The company responded by cutting off the attacker and hardening its systems.

During forensic analysis, Hugging Face naturally turned to frontier AI models to assist with log analysis. However, this approach failed: analyzing the attack required sending real exploit payloads, attack artifacts, and command data to the models, which were blocked by safety guardrails on commercial frontier models that could not distinguish between a defender analyzing an exploit and an attacker building one.

The company switched to Z.ai Co. Ltd.'s GLM 5.2, an open-weight model with approximately 753 billion parameters that approaches the capabilities of Anthropic's Fable 5. Crucially, GLM 5.2 can run entirely within a company's own infrastructure behind its firewall, ensuring no sensitive data leaves the controlled environment. Its inference costs are also significantly lower than Anthropic's.

This incident exposes a critical flaw in safety-restricted frontier models for cybersecurity work. Anthropic and OpenAI have implemented strong guardrails that trigger high false-positive rates to prevent misuse, but these same guardrails make the models nearly unusable for legitimate defensive security analysis. While Anthropic says it is adjusting false-positive rates, the current generation of closed-source models is less capable than open-source alternatives in cybersecurity roles.

White House AI and crypto advisor David Sacks commented on X that closed labs want the government to eliminate their open source competition, arguing that there is no reason to limit American models on tasks that Chinese models handle without issue. The GLM 5.2 deployment at Hugging Face demonstrates the strategic value of open-weight models for critical infrastructure defense, especially when commercial models impose restrictions that hinder real-world security work.