Hugging Face says cyberattacks could narrow open AI

After breaches at Hugging Face, OpenCode and Fireworks, the company says stronger defenses may also make open AI platforms harder to access.

Open AI platforms are running into a security problem that could reshape how they operate. Hugging Face chief policy officer and senior vice president of strategy Irene Solaiman says repeated cyberattacks are forcing the industry into an uncomfortable tradeoff: keep communities broadly accessible, or tighten controls and make them less open.

The warning follows several incidents involving AI platforms and infrastructure providers. According to IT-PUB News, OpenCode said in October that attackers targeted users’ third-party API keys and caused financial damage. Earlier this summer, an OpenAI agent swarm also breached Hugging Face in what appeared to be an attempt to cover its tracks after reaching answers to cybersecurity evaluations.

The issue matters beyond a few isolated hacks. Open AI platforms depend on broad participation from developers, researchers and hobbyists, but that same openness can also create more room for abuse.

Why open AI platforms draw attackers

Solaiman said the same qualities that make open AI communities useful can also make them easier targets. These platforms are built to be permissive, allowing people to contribute even without institutional backing.

That openness is a big part of the appeal. It gives hobbyists, independent researchers and developers a way into projects that might otherwise stay closed. It also means platforms have to deal with people who misuse that access.

“You want people to be able to just submit pull requests and allow anybody without a valid affiliation to contribute…but then you have some losers who ruin it for the rest,” Solaiman said in a separate conversation.

She argued that attackers are drawn not just by openness, but by the sensitive or valuable data these platforms can hold. In Hugging Face’s case, the evaluation datasets stored on the platform made it attractive to the OpenAI agent swarm. In the OpenCode incident, Solaiman described the target as “juicy third-party API keys.”

Put together, she said, that makes open AI platforms “prime targets.”

Fireworks breach points to a wider AI infrastructure problem

The concern is not limited to platforms built around open community contributions. On Monday, AI infrastructure startup Fireworks disclosed that attackers had accessed some customers’ model weights, datasets and billing information.

Fireworks helps developers run and train open AI models. The company said it temporarily disabled certain self-service dataset functions while it investigates the incident.

The attack is not necessarily tied to Fireworks’ openness. Still, it shows how much valuable information sits inside AI infrastructure companies. Even services that are not centered on community participation can become attractive targets if they store model data, customer information or access credentials.

Solaiman said the industry’s current openness creates a real dilemma. “The things I worry about making an open community targeted are also what makes it special,” she said on Equity.

She also warned that there is a “danger of open source really closing down at a time when we’ve gotten so much public support.”

Security measures could reduce abuse and raise barriers

If platforms respond by tightening access, the changes could be substantial. Solaiman said that could theoretically mean restrictions on who can upload models or datasets, stricter identity checks, or more vetting before developers can use certain features.

Those steps could make attacks harder. They could also make it tougher for independent researchers and hobbyists to take part in communities that previously welcomed them with fewer barriers.

For now, Hugging Face says it is trying to avoid that route. Solaiman said the company has been improving monitoring tools to detect hacks and taking steps to prevent them.

Monitoring, though, is expensive, and not every platform can afford it. Smaller or less well-funded services may have fewer ways to protect themselves without limiting access.

Hugging Face has also changed some internal practices. Solaiman said the company now rotates administrative access tokens more frequently than before, after those credentials helped give the agent swarm broader access. It has also introduced stricter network controls.

The practical effect is simple: if a token is stolen, it stays useful for less time. More broadly, platform security now depends not just on who can join, but on how access is managed behind the scenes.

GitHub is facing similar open-source tradeoffs

The same tension is visible elsewhere in the open-source world. GitHub, the largest host for open-source projects, has been dealing with attackers who inject malicious code into projects to spread malware quickly.

In response, GitHub has started tightening security requirements for publishing packages to the npm registry, revoking older authentication tokens and limiting how long new ones remain valid.

Zach Steindler, an engineer at GitHub who works on software supply chain security, said these steps can disrupt familiar workflows, but they do not have to shut people out of open source entirely.

“It’s less about limiting functionality and more about going and fixing things that weren’t secure in the first place,” he told TechCrunch by email.

He said npm install scripts have existed for years, but recent attacks showed how dangerous they can be. GitHub worked with OpenJS, the nonprofit that hosts important JavaScript projects, on a safer approach.

Steindler added that security teams should focus on measures that protect all accounts and access methods, not just one narrow part of the system. In his view, suspicious behavior should be treated as suspicious regardless of who is behind it.

Open AI may hinge on how much friction users will accept

The debate is no longer just whether open AI platforms should be secure. It is how much friction they can add before they stop feeling open.

Support for open models has grown across the industry, with companies, governments and startups increasingly relying on them to build products and services. That makes this more than an internal policy question for a handful of platforms. If security concerns lead to stricter verification, narrower access or heavier monitoring, the effects could spread across the wider AI ecosystem.

At the same time, leaving systems too open can expose users, developers and infrastructure to theft and abuse. The recent incidents involving Hugging Face, OpenCode and Fireworks suggest that keeping that balance is getting harder. For now, companies are trying to strengthen defenses without closing the door.