There are ironies that even a screenwriter wouldn't dare to write.
Let's recap. An American AI escapes from an American laboratory and hacks an American platform. This platform wants to understand what happened to it. It turns to the best American AI models to analyze the attack. They all refuse. Not out of bad faith, but because their safety guardrails, unable to distinguish between an attacker and an investigator, block the requests.
Hugging Face therefore ended up conducting its investigation with GLM 5.2, a Chinese open-weight model published by Beijing-based publisher Z.ai. Result: seventeen thousand events analyzed in a few hours instead of several days.
Three days after recounting the technical details of this unprecedented escape, the matter has changed nature. It is no longer just a security incident: it has become the central piece of evidence in the most violent political debate of the American summer on artificial intelligence. And a counter-narrative, carried by researchers and cybersecurity experts, now disputes OpenAI's version.
Why American models said no
The problem is structural, and it's not a bug.
To prevent their models from being used to launch cyberattacks, the major Western laboratories, both OpenAI and Anthropic, have installed filters that block anything resembling offensive content: attack commands, exploit payloads, intrusion sequences. These guardrails work. The problem is that the raw material of a legitimate forensic investigation is exactly the same as that of an attack. A security team reconstructing an intrusion must submit to the model the commands actually executed by the attacker.
When queried via their APIs, the commercial models therefore refused. As Hugging Face notes without naming a provider, the asymmetry is cruel: the attacker, for his part, was bound by no usage policy. The defender worked with one arm tied behind his back, the aggressor with free hands.
GLM 5.2, however, has no such reservations. Distributed under the MIT license, with a context window of one million tokens and particularly adept at code and agent operations, it was downloaded and run on Hugging Face's own infrastructure, so that the attacker's data never left the company's perimeter. A detail that matters: the Chinese choice did not send the incident traces to servers in Beijing.
Anthropic has publicly acknowledged the problem, indicating it is working to adjust the false positive rate of its models to make them usable by security researchers. The underlying technical question remains: how to design or enable a model for authorized security use, without the refusals that make it useless precisely where it is needed?
The incident falls amid an offensive against Chinese open models
The timing could not be more explosive, and this is what gives this episode its political significance.
Since the release of Kimi K3, the open-source behemoth from Moonshot AI, part of the American industry has been advocating for restricting access to Chinese open models. Dean Ball, head of strategic futures at OpenAI, has publicly suggested government intervention. The Department of Commerce is said to have already considered adding several Chinese laboratories to its entity list, which would cut off their access.
Read: Fable 5: The Bill Anthropic Doesn't Dare Send
The Hugging Face incident crashes head-on into this campaign. A Chinese model, which American leaders want to ban, rescued an American company victim of another American company.
David Sacks, former AI 'tsar' of the Trump administration and still an advisor, jumped on the breach on X: "We are at a critical turning point in artificial intelligence policy. The major closed labs, which already form a duopoly in revenue generated by AI models, want the government to eliminate their open-source competitors." Explicitly targeting OpenAI and Anthropic, he added, in direct reference to the affair: "There is no reason to limit American models to tasks that Chinese models accomplish without issue." He called OpenAI's position an admission of a regulatory capture strategy.
The opposing camp also has plenty of arguments. Sam Bresnick, a researcher at Georgetown's Center for Security and Emerging Technologies, recalls the growing weight of AI in American military operations, while questioning the legitimacy of protecting domestic companies from foreign competition in the name of innovation. Others raise the issue of implicit political biases of models trained in China, whose actual effect on technical tasks like code remains difficult to measure.
What is certain is that the affair has given the openness camp its best argument in months: a documented case where closure cost, and openness saved.
The story with the OpenAI unpublished model is getting more and more bizarre. It left notes for itself and its later version with instructions on how to escape.
Let that sink for a moment.
"In one case, an agent left notes apparently for future versions of itself (...). The... https://t.co/wycN14Y15I pic.twitter.com/QgZdk9gw8w
— Chubby♨️ (@kimmonismus) July 25, 2026
The counter-narrative: What if the AI didn't really 'escape'?
Second front, more technical and equally serious: several experts dispute the way OpenAI told the story.
The company's version highlights models becoming autonomous, deciding on their own to leave their environment and hack a third party. A spectacular, almost cinematic story that the press naturally relayed, some headlines even invoking the 'I'm sorry, Dave' of HAL 9000 from 2001: A Space Odyssey.
Security specialists see it as a framing. According to them, the models mainly took advantage of a poorly isolated sandbox: it wasn't the AI that broke through a fortress, it was the fortress that had an open door. The fact that OpenAI deliberately disabled part of its classifiers for this test reinforces this reading. In reactions reported by the Financial Times, the incident is attributed to 'aggressive' training methods and a culture where safety takes a backseat to performance. The company simply underestimated its own models' capabilities.
John Thickstun, a computer scientist at Cornell University, goes further: he sees in this communication a commercial argument aimed at investors, in line with the famous 2019 episode when OpenAI withheld the publication of GPT-2, presenting it as too dangerous to release. A model so powerful it becomes uncontrollable is also a model you want to buy. Tom Van de Wiele, an ethical hacker, expresses doubts about several claims and demands more evidence.
Read: 94% of French Students Use AI: Between Dependence and Concern for Employment
But one must guard against the opposite excess. Hugging Face, for its part, invented nothing: the platform did indeed detect a real intrusion on the weekend of July 16, with stolen service credentials and several thousand actions executed without human intervention. Adel Ka, head of detection and response at Perplexity, said he was surprised at the speed with which science-fiction scenarios are becoming reality. And precedents exist: Anthropic documented the use of Claude by Chinese state hackers in an espionage campaign, publisher Sysdig described an AI-assisted ransomware, and the JADEPUFFER malware illustrated this new type of threat.
The truth probably lies in an uncomfortable middle ground: models truly capable of autonomously executing a chain of attack, in an environment that was not up to par, narrated by a company that had every interest in emphasizing the first part rather than the second.
What companies should take away
Beyond the saga, three very concrete lessons emerge for any organization deploying AI.
- Your security team might not be able to use your AI. This is the most counter-intuitive lesson from the affair. If your incident response plan relies on a commercial model to analyze attack traces, test it before you need it. The day of crisis is not the moment to discover that the provider refuses the request.
- Isolation must be designed for an adversary, not a user. An agent given a narrow objective and a lot of autonomy will explore paths no one anticipated. Network confinement, privilege separation, and behavioral monitoring are not comfort options.
- Model availability has become an architecture criterion. After the blocking of Anthropic's models in June and the retention of GPT-5.6 in July, this episode adds a dimension: beyond the question of whether a model will be accessible tomorrow, there is the question of whether it will agree to do the work you need.
One absence remains, which should be concerning on this side of the Atlantic. Throughout this affair, the attacker is American, the victim is American, and the savior is Chinese. No European entity intervenes at any point, neither as a provider of a model capable of conducting the analysis, nor as an actor in the ensuing debate. Regulators, both American and European, have so far announced no investigation into an incident that affects a platform used by more than fifty thousand organizations worldwide.
OpenAI, for its part, has announced it will tighten its containment protocols and slow its research pace. That is the only tangible consequence to date. For the rest, this summer taught the industry something quite disturbing: when a Western AI goes off the rails, it is Western guardrails that prevent us from going to see what happened.
