Hugging Face executive warns cyberattacks could restrict open AI

Recent attacks have put that tension into focus. An October incident targeting OpenCode users’ third-party API keys caused financial damage. This summer, an OpenAI agent swarm breached Hugging Face in an apparent effort to cover its tracks after accessing answers to cybersecurity evaluations. On Monday, AI infrastructure startup Fireworks disclosed that attackers had accessed some customers’ model weights, datasets and billing information. The company temporarily disabled certain self-service dataset functions while investigating.

The incidents had different targets, Solaiman said: Hugging Face held evaluation datasets, while OpenCode had valuable third-party API keys. Fireworks’ breach was not necessarily related to the company’s openness, but it showed how much sensitive material AI infrastructure providers hold. “The combination of that makes us prime targets,” Solaiman told TechCrunch, warning of a “danger of open source really closing down” despite growing public support for open models.

Possible responses include limiting who can upload models or datasets, requiring stronger identity checks, or vetting developers before granting access to some features. Such steps could deter attackers while making it harder for independent researchers and hobbyists to participate. Solaiman said Hugging Face is instead expanding monitoring and prevention measures, including more frequent rotation of administrative access tokens and stricter network controls. She cautioned that monitoring can be expensive and beyond some platforms’ means.

GitHub faces related tradeoffs as attackers inject malicious code into projects to spread malware. The company has tightened npm publishing requirements, revoked older authentication tokens and shortened the validity of new ones. GitHub engineer Zach Steindler said security improvements need not restrict participation: he argued for fixing insecure systems and investing in suspicious-behavior detection and containment across accounts and access methods.