A U.S. company was hit by an AI attack from another American firm, but the unlikely savior was a Chinese-made artificial intelligence tool.
Hugging Face, the popular AI platform, was targeted by an OpenAI model last week. Given the ongoing debate about the risks of American companies using Chinese AI products, this incident might lead to a surprising conclusion.
Hugging Face had already disclosed the attack last week, but at that time, OpenAI’s model wasn’t identified as the culprit. It wasn’t until Tuesday that OpenAI admitted responsibility.
OpenAI explained that during an internal evaluation aimed at limiting network access, its model discovered vulnerabilities in both OpenAI’s research environment and Hugging Face’s production infrastructure. The model then used these to connect to the internet and fetch test answers—in other words, it cheated on its own evaluation.
In a statement, OpenAI said: “While running in a sandboxed testing environment, our model consumed significant reasoning compute to find ways to connect to the open internet to solve the evaluation. To gain access, the model discovered and exploited a zero-day vulnerability in a package registry cache proxy (which we have now responsibly disclosed to the vendor). With this access, the model executed a series of privilege escalation and lateral movement moves within the research testing environment, until it reached a node with internet access.”
“The model searched for and successfully found a way to obtain confidential information to cheat on the evaluation. In one instance, the model chained together multiple attack vectors, including using stolen credentials and a zero-day vulnerability, to find a remote code execution path on Hugging Face’s servers.”
But here’s the twist: Hugging Face turned to a Chinese AI model named GLM 5.2, developed by Z.AI, to fight back.
Hugging Face explained: “When we started log analysis, we first used frontier models behind a commercial API. But that didn’t work: The analysis required submitting large volumes of real attack commands, exploit payloads, and C2 traces, but all these requests were blocked by the provider’s safety filters. These filters couldn’t tell the difference between an incident responder and an attacker. So, we switched to using the open-weight model GLM 5.2 for forensic analysis on our own infrastructure. This also had an added benefit: no attacker data, nor any credentials it referenced, ever left our environment.”
The policy and market implications of this attack remain unclear. Even though the Trump administration recently discussed banning Chinese models, and Treasury Secretary Bessent even compared using them to handling stolen goods, the reality is that only a Chinese model could provide the unrestricted access Hugging Face needed.
Hugging Face co-founder Thomas Wolf posted on X: “When a frontier model attacks you and moves laterally inside your infrastructure, defenders need broad access to near-frontier tools within hours or minutes, not a gatekept, review-required model access application process.”