Hugging Face says incident response failed on commercial APIs until it switched to local GLM 5.2

kchonyc · x · 2026-07-21

Hugging Face’s incident report highlights a practical lesson from its forensic response: frontier commercial APIs were blocked by safety guardrails during log analysis, so the team switched to GLM 5.2, an open-weight model running on its own infrastructure.

The report argues that teams should pre-stage a capable model they can run locally before an incident, both to avoid guardrail lockout and to keep attacker-linked credentials from leaving the environment.

Related event: HF Hit by AI Agent Cyberattack, Pivots to Open-Source Model for Defense(26 posts)→

Original post →

More from Infra

Infra channel →