Hugging Face defends agentic AI attack with Z.ai's GLM 5.2

Hugging Face detected and responded to an agentic AI attack and used Z.ai's open weight GLM 5.2 because frontier models were hampered by safety guardrails. There are multiple takeaways from Hugging Face's recap and enterprises need to take notes.

Here's a look at the lessons from Hugging Face.

First, Hugging Face detected and responded to an intrusion of its systems by an autonomous AI agent system that accessed a limited set of internal datasets and several credentials. Details are still being sorted out, but the main point is that Hugging Face spotted an agentic AI attack in the wild.

The attack used what appeared to be an agentic security-research harness with an unknown large language model. This system executed "many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services."

That attack on its own would have been news, but the biggest takeaways is how Hugging Face defended itself.

Hugging Face said (emphasis mine):

"When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.

This experience points to a gap worth planning for. We do not know which model powered the attacker's agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried. The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment. This is not an argument against safety measures on hosted models, and we are sharing this feedback with the providers concerned."

• Is a FINRA-ish group the answer for frontier AI standards?
• DeepSeek's real impact happening now
• Moonshot AI launches Kimi K3
• Fable 5 and the Shift From Model Capability to Capability Governance
• Claude Mythos and the New Cybersecurity Operating Model

In other words, the safety guardrails in frontier models that are supposed to protect actually became a liability and pushed Hugging Face to an open weight model deployed on its own infrastructure. In the comments of Hugging Face's post, some noted that at least the company had some of its own infrastructure. It was pointed out that you could string together a handful of Nvidia Spark machines, now available through multiple OEMs, to string together your own GPU cluster without breaking the bank.

Hugging Face also used LLM triage over security telemetry to root out the attack. The full attacker action log included 17,000 recorded events.

What Hugging Face's recap means for you is the following:

• Safety guardrails in frontier models may not have the intended effect.
• Create your own plans to use open weight models on your own infrastructure.
• These plans are going to be fluid since agentic AI attacks are new.
• Expertise is going to be at a premium and security vendors will have to step up their game potentially with open-weight models.