Cyberattacks threaten to make open source AI a little less open, Hugging Face exec warns 

Summary

Hugging Face chief policy officer Irene Solaiman warned that rising cyberattacks on open AI platforms could push providers toward tighter security restrictions. She cited the October attack on OpenCode, which targeted users' third-party API keys and caused financial damage, and a summer incident in which an OpenAI agent swarm breached Hugging Face. Fireworks also disclosed that attackers accessed some customers' model weights, datasets, and billing information.

Mitigation

Solaiman said Hugging Face has been beefing up monitoring tools and taking steps to prevent hacks. It now rotates administrative access tokens more frequently and has stricter network controls.

Related items

• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSame vendor · NVD/CVE Database
• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSame vendor · CNBC Technology
• InfoHugging Face’s CEO Says His P(Doom) Is ‘Close to Zero’Same vendor · Wired (Security)
• InfoBuilding on open source AI? Hugging Face’s policy chief on the costs, risks, and trade-offsSame vendor · TechCrunch (Security)
• MediumBeyond deterministic worms: Preparing the SOC for reasoning adversariesSame vendor · CSO Online