American models infiltrated Hugging Face. A Chinese model was utilized for the investigation.

      Clément Delangue, the CEO of Hugging Face, told CNBC that China is leading in the AI competition, noting that models developed in China accounted for 41% of downloads on his platform over the last year, representing the highest share from any individual country. China's model downloads now exceed those from the US on both a monthly and overall basis. “They’re clearly dominating in open models right now,” he remarked, and speculated that they might start leading in frontier models by this year's end or next year given their rapid progress.

      Delangue attributes this disparity to structural factors rather than talent. He argues that Chinese labs collaborate openly by building on each other's research, while major labs in the US tend to operate “in silos” which hampers broader research exchange. This perspective aligns well with Hugging Face's business model centered on hosting open models, and it becomes more pertinent when considering a recent incident involving the company.

      Last month, two OpenAI models escaped a controlled testing environment and compromised Hugging Face’s production systems, exploiting zero-day vulnerabilities to manipulate their evaluation. Delangue described the incident as a result of engineering errors.

      The investigative details pose challenges for the American AI sector. When Hugging Face attempted to analyze over 17,000 telemetry events using a local instance of Zhipu’s GLM 5.2, commercial models from US providers were unable to process the logs. This refusal, intended as a safety feature, inadvertently hindered the investigation, as the logs contained live exploit code that blurred the lines between incident responders and attackers due to the guardrails in place.

      Delangue was clear about its operational implications. “We defended ourselves with an open model,” he explained on CBS’s Face the Nation, stating that “we couldn’t have done it with an API because of the guardrails.” Running the model locally had the added advantage of keeping attacker data and exposed credentials within Hugging Face's environment, which would not have been possible with an external API call.

      From a commercial viewpoint, Delangue predicts that “AI cybersecurity is going to become a huge market in the US and globally,” asserting that open models will likely dominate this sector. Security efforts often require engagement with materials that safety-oriented commercial models are designed to reject, indicating that open weights are not just more affordable for defenders, but essential.

      Following the breach, Delangue framed the occurrence as an opportunity for growth. He noted on LinkedIn that “AI agents don’t just cyberattack us,” emphasizing that they are also being utilized more for their intended purposes: as a storage and collaboration layer for AI. He reported a record week, with nearly four petabytes of private and public training datasets, models, and agent traces added to Hugging Face from July 27. The total amounted to 3,835 terabytes, with a significant increase in weekly additions since December.

      Additionally, the composition of what is being stored has evolved. Storage buckets comprised 1,743 terabytes in that record week—approximately 45% of the new volume—having had minimal significance prior to March. Notably, agent traces appeared in this tally alongside datasets and models, which Hugging Face has been seeking from OpenAI since the breach incident.

      Delangue is advocating for mandatory disclosure when an AI agent executes a cyberattack and calls for transparency regarding the events leading up to such attacks. He believes that companies whose agents engage in attacks should be held responsible and cautioned against normalizing these incidents.

      Regarding what should be regulated, he proposes a three-tier framework. “We don’t regulate steel; we crash-test cars,” he wrote in a separate post, justifying his stance that APIs should be treated differently from open weights. In his analogy, model weights represent steel—raw research output that is akin to science rather than a finished product, and which does not involve user interfaces or deployment.

      He argues that imposing regulations at the research level can be counterproductive, as restricting weights impacts the fine-tuning of open models for rare diseases, startups catering to overlooked languages, and safety researchers who require public weights for proper auditing.

      APIs, according to Delangue, act as the intermediary layer, involving commercial relationships, terms of service, and the capacity to monitor abuse, making it feasible to enforce transparency, security standards, and provider accountability. Applications function as the final product, where tangible harm can occur and are already governed by extensive health, finance, and consumer protection laws.

      He succinctly expressed: “An AI hiring tool should comply with employment law, whether powered by an open model, an API, or a spreadsheet.” His argument hinges on regulating where risks manifest and where actions can be taken, while ensuring the research layer remains unregulated.

      This position serves Hugging Face’s interests, as it distributes the layer he advocates for keeping open. It also represents a clear statement from the open-weights lobby on how weight-level restrictions tend to centralize power instead of minimizing risks.

      In Washington