Ozan Ahmet CetinFor years, warnings about artificial intelligence escaping its controls were easy to dismiss as science fiction dressed up as policy.
Then, OpenAI disclosed last week that models it was evaluating for offensive cyber capability broke out of a sandbox, gained access to the open internet, and compromised Hugging Face, one of the world’s most important repositories for AI models and datasets.
The breach was nothing like the familiar science-fiction scenario in which a machine becomes self-aware, turns against its creators, and tries to escape.
OpenAI says the agent was pursuing the narrow goal of solving problems in a cybersecurity benchmark called ExploitGym.
To do so, it found a previously unknown vulnerability in a package-registry proxy, moved through OpenAI’s research environment, reached the internet, inferred that Hugging Face might hold useful test material and penetrated its systems to obtain information that could help it pass.
In plain language, the agent cheated.
An AI agent is different from a chatbot. A chatbot answers a question and waits. An agent can break a task into steps, run code, inspect the result, adjust its plan and continue. According to OpenAI, the agent was powered by multiple models.
This time, cheating was more than a chatbot giving a wrong answer or inventing a citation. It crossed real organisational boundaries, used stolen credentials and exploited software vulnerabilities because those actions served the goal it had been given.
The incident is crucial in the sense that it turns a theoretical fear into an operational fact. We have seen a case where an AI agent can take harmful actions in the real world without possessing hatred, ambition or self-awareness.
This distinction should cool the more theatrical claims surrounding the breach while sharpening the political issue. It is a machine that treats containment, laws and other people’s infrastructure as obstacles within an optimisation problem.
Open versus closed models
The incident has disrupted the familiar debate between closed and open AI. The attacking system was powered by proprietary frontier models, including GPT-5.6 Sol and a more capable unreleased model.
The defending organisation, Hugging Face, ultimately relied on GLM 5.2, an open-weight model developed by China’s Z.ai.
Hugging Face said its investigators needed to analyse more than 17,000 recorded events, including real attack commands, exploit payloads and command-and-control traces.
Commercial (closed) AI services initially blocked parts of that work because their safety systems could not distinguish a defender examining malicious code from an attacker requesting assistance.
Hugging Face then used GLM 5.2 locally, which allowed its team to reconstruct the attack faster without sending credentials and sensitive evidence to an outside provider.
This is the strongest argument for open-weights to emerge from the affair. During an emergency, defenders cannot depend entirely on a remote company’s usage policy, availability or interpretation of acceptable activity.
Other institutions such as banks, hospitals and governments may also need models that can inspect classified, personal or commercially sensitive evidence inside their own networks.
Local control can preserve confidentiality and ensure that a provider cannot switch off the tool at the worst possible moment.
There is a wider democratic argument too. If the most capable AI systems are accessible only through a handful of corporate gateways, those companies become private regulators of knowledge and security.
They decide who may use advanced capabilities, for what purpose and under which geopolitical conditions.
Conversely, open models can spread technical capacity among universities, smaller companies and countries that cannot build frontier systems from scratch.
That logic is already shaping industry response. Days after the breach, Nvidia formed the Open Secure AI Alliance with founding members including Adobe, CrowdStrike, Dell Technologies and Hugging Face.
The coalition plans to develop and share open tools for AI safety and cybersecurity, including systems for testing, tracking and reviewing the behaviour of autonomous agents.
However, the open-source community should resist turning the incident into a victory parade.
Open models can help distribute defence, but they can also distribute offensive capability. Openness is neither the problem nor the solution by itself. It is a choice about who receives power, under what conditions, and whether that transfer can ever be reversed.
The same quality that made GLM 5.2 useful to defenders, the ability to run and modify it without external control, can make an open-weight model useful to attackers.
Once model weights are released, they can be copied indefinitely, stripped of safeguards and operated without logging or rate limits.
The AI Security Institute from the UK recently found that leading open-weight cyber models were only four to seven months behind the closed frontier in several evaluations.
To many observers, that is a shrinking gap rather than a permanent margin. The institute also warned that once weights are publicly released, providers lose many of the tools available to detect misuse, update safeguards, block users or withdraw access.
Sovereignty beyond Washington and Beijing
This has direct consequences for countries outside the United States and China.
Dependence on proprietary foreign application programming interfaces, or APIs, can expose governments and companies to price changes, service withdrawal, political pressure and cross-border data risks.
Open weights can support technological sovereignty by allowing models to be adapted to local languages, laws and security needs.
Yet sovereignty cannot be reduced to downloading a model. Running powerful systems requires chips, electricity, data centres, skilled engineers and secure software supply chains.
A country that hosts a foreign model locally may protect its data while remaining dependent on foreign hardware and cloud infrastructure.
The practical concerns are who operates the system, who can inspect it, where the data goes and who has the authority to disable it. These questions are more useful than asking whether a model is American or Chinese.
The Hugging Face incident makes this point with unusual clarity. A proprietary American system crossed the boundary.
A Chinese open-weight system helped reconstruct the intrusion. The episode refuses to fit neatly into the geopolitical narratives preferred by either Washington or Beijing.
It also shows why countries should avoid replacing technological dependency with technological isolation. Few states can reproduce the full AI supply chain domestically.
The realistic objective is strategic capacity with local expertise, access to several model providers, domestic computing resources and the ability to change suppliers.
The lesson is not that open models are safe and closed models are dangerous, or the reverse.
It is that advanced AI systems are becoming powerful enough to cross institutional boundaries, while the rules governing their deployment remain fragmented and largely voluntary.
The central policy challenge is therefore to build systems of accountability that follow capability rather than corporate form.
For countries outside the two dominant AI powers, the priority should be the ability to understand, supervise and, when necessary, replace the systems on which critical institutions rely.
The Hugging Face breach is a warning that control over AI depends on who can examine its behaviour, contain its actions and answer for the consequences when containment fails.
