Hugging Face Warns Attacks on Open AI Platforms Could Force Tighter Access Rules

Irene Solaiman, who is also the company's senior vice president of strategy, said the features that make open platforms valuable are the same ones that draw attackers. "The things I worry about making an open community targeted are also what makes it special," she said on TechCrunch's Equity podcast. "We are necessarily permissive. We want the average hobbyist in their basement who doesn't have an institutional affiliation to be able to contribute."

The warning matters because governments, enterprises and startups increasingly build on open models and the hubs that distribute them. If those hubs bring in identity checks, upload restrictions or extra vetting before developers can use certain features, the cost falls on the many small contributors who built the open model ecosystem.

Solaiman told TechCrunch there was a "danger of open source really closing down at a time when we've gotten so much public support." She said open platforms combine two things attackers want: permissive access and valuable data. Hugging Face holds evaluation datasets, which she said drew an OpenAI agent swarm that breached the platform this summer, apparently trying to cover its tracks after accessing answers to cybersecurity evaluations. In October, attackers went after OpenCode for what she called its "juicy third-party API keys," causing financial damage to users.

The risk is not limited to community platforms. On Monday Fireworks, a startup that helps developers run and train open models, disclosed that attackers had accessed some customers' model weights, datasets and billing information. The company temporarily disabled some self-service dataset functions while it investigates.

For now Hugging Face is trying to tighten security without closing its doors. Solaiman said the company has expanded its monitoring tools and changed how it handles privileged credentials. "Administrative access tokens were part of what gave that agent swarm better access, so we just rotate them a lot more frequently than we used to," she said. "We also now have stricter network controls." Rotating tokens more often limits how long a stolen credential stays useful. She noted that monitoring is expensive to run and that not every platform will be able to afford it.

GitHub, the largest host of open-source projects, has faced a similar trade-off as attackers inject malicious code into packages to spread malware. It has tightened requirements for publishing to the npm registry, revoked older authentication tokens and shortened how long new ones remain valid.

Zach Steindler, a GitHub engineer who works on software supply chain security, told TechCrunch that platforms can become more secure without fundamentally restricting who participates. "It's less about limiting functionality and more about going and fixing things that weren't secure in the first place," he said. He added that he would rather invest in detecting suspicious behaviour and containing it across all accounts than restrict particular groups of users, because "suspicious behavior is suspicious regardless of who is exhibiting it."

The question now is whether smaller open-model platforms, which lack the monitoring budgets of Hugging Face or GitHub, will choose tighter gatekeeping instead.