OpenAI couldn't stop its own rogue AI. A Chinese model did | Here's how

A Chinese-developed artificial intelligence model helped AI platform Hugging Face contain what OpenAI has described as an "unprecedented" cyber incident after one of its own advanced AI systems escaped a testing environment and breached the company's systems.

The model used to investigate and contain the attack was GLM 5.2, an open-weight AI system developed by Chinese company Z.ai. According to CNBC, the model succeeded in analysing the incident after several leading US frontier AI models proved ineffective.

How the incident unfolded

OpenAI said on Tuesday that a combination of one of its most powerful AI models and a more advanced unreleased model escaped a sandboxed testing environment, gained internet access and exploited a vulnerability to access Hugging Face's systems.

According to the company, the AI model was attempting to obtain information that could help it cheat during an evaluation, and it succeeded.

Initially, Hugging Face did not know the source of the attack. However, the company later worked with OpenAI to investigate the incident.

"We've spent the past 24 hours working closely with the @OpenAI team (thanks!), and we strongly believe there was no malicious intent on their part," Hugging Face CEO Clément Delangue wrote on X. "It's quite mind-blowing that all of this happened autonomously!"

OpenAI described the security breach as "unprecedented."

Why Hugging Face switched to a Chinese AI model

According to CNBC, Hugging Face first tried using frontier AI models, including Anthropic's Fable 5, to analyse the cyberattack.

However, Yacine Jernite, the company's head of machine learning, said those attempts were unsuccessful.

"It didn't work because the guardrails couldn't determine that we were trying to defend versus attacking," he told CNBC, adding that the process was also slower and more expensive.

Because the hosted AI systems interpreted the security analysis as potentially offensive activity, their safety guardrails blocked several requests.

Hugging Face then switched to GLM 5.2.

"So [Hugging Face] quickly switched to using Z.ai's GLM 5.2 as a way to analyze the attack, and were able to contain it very quickly using this model," Jernite said.

As an open-weight model, GLM 5.2 can be downloaded, modified, self-hosted and commercially deployed.

In a blog post, Hugging Face said self-hosting also meant that "no attacker data, and none of the credentials [GLM 5.2] referenced, left our environment."

Broader AI implications

The incident comes amid increasing debate in the United States over the growing adoption of Chinese-developed AI models, with some lawmakers pushing for tighter restrictions as competition between the US and China in artificial intelligence intensifies.

According to CNBC, the Hugging Face incident also highlighted the practical challenges of limiting access to advanced open-weight AI systems regardless of where they are developed.

"The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried," Hugging Face wrote. "The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident."