The Wire

Hugging Face reconstructs its breach on a self-hosted open model

By Hugging Face's account, commercial tools refused the attacker's payloads mid-breach, so it rebuilt the 17,000-event intrusion on an open model it hosted itself, a case for keeping one in the incident-response toolchain.

5 min read2026-07-21

engineering

Hugging Face reconstructs its breach on a self-hosted open model¹

Hugging Face disclosed on July 16 that an autonomous agent framework breached its production infrastructure over a weekend, executing more than 17,000 recorded actions across a swarm of short-lived sandboxes after a malicious dataset abused a remote-code loader and a template-injection path in its dataset processing.¹ The intrusion reached a limited set of internal datasets and several service credentials. Public models, datasets, and Spaces were not touched, and neither was the software supply chain.¹ To rebuild the sequence of events from that 17,000-event log, the company ran GLM 5.2, an open-weight model, on its own infrastructure.¹

Hugging Face says it self-hosted because the commercial models it first reached for refused to examine the attacker's payloads, treating the malicious commands and exploit code the forensics required as hostile traffic.¹ That account is the company's own, and no independent security researcher has confirmed it. Fortune reports the disclosure carries zero outside expert commentary, and that its only public backers are voices aligned with unrestricted AI development.² The operational lesson rests on what Hugging Face did, and it holds even if its explanation does not: a defender racing a machine-speed intrusion cannot wait on a hosted model that may refuse the query. Keep a model you can run yourself in the incident-response toolchain, and test it on real attack artifacts before an incident forces the question.

compute

Google is designing a chip that bakes Gemini into silicon³

The Information reported on July 20 that Google is building a chip, codenamed Frozen v2, that hardcodes parts of Gemini's architecture into silicon.³ The chip targets six to ten times more tokens per unit of power than Google's newest TPUs, for deployment as early as 2028, and Google declined to confirm it, saying only that its teams are "constantly researching and experimenting with new innovations" for efficiency.⁴ The reason to spend years baking a single model into hardware sits in a number the chip news does not mention.

Across the five largest hyperscalers, Epoch AI finds operating cash flow growing about 23 percent a year while cash capital spending grows about 70 percent, so aggregate cash capex is on track to overtake operating cash flow around the third quarter of 2026.⁵ Past that point, Epoch notes, further spending has to be financed by other means.⁵ The crossover is staggered by company: Oracle is already past it, Amazon arrives around the second quarter of 2026, Alphabet near the first quarter of 2027, Meta the third quarter of 2027, and Microsoft not until the third quarter of 2028.⁵ The buildout itself is intact: hyperscalers are still guiding to roughly $725 billion in 2026 AI capital spending, up 77 percent from 2025.⁶ That is why the power a token costs to serve has become the variable Google is now engineering around. When you weigh the next generation of inference silicon, read power per token against your serving cost, not peak throughput against a spec sheet.

policy

Britain measures the open-weight cyber gap at four to seven months⁷

The UK AI Security Institute published on July 17 the first public measurement of how far leading open-weight models trail the closed frontier on cyber capability, and put the gap at four to seven months, down from the six-to-ten-month gaps it measured through 2025.⁷ It scored models on narrow tasks spanning vulnerability research, reverse engineering, web exploitation, and cryptography, and on "cyber ranges" that test whether a model can plan and execute a multi-step attack end to end.⁷ The open models it tested, GLM-5.2 and DeepSeek V4-Pro, now sit within half a year of closed comparators such as Opus 4.6 and GPT-5.5.⁷

The larger shift is in cost. Reading the same evaluation, The Decoder puts the per-task cost of the open models far below the closed ones: about $6 for GLM-5.2 and 28 cents for DeepSeek V4-Pro against roughly $15 for Opus 4.6, and on identical workloads at scale, $1.19 for DeepSeek against $85 for Opus.⁸ A shrinking time gap is a defender's problem measured in months. A seventyfold cost gap is an attacker's opportunity measured in runs.⁸ AISI notes the same open models carry real privacy and customization advantages the threat framing omits.⁷ If you model the risk from open-weight models, price it on cost per attack, because the capability lag is closing slowly and the cost is collapsing fast.

industry

Alibaba previews a 2.4-trillion-parameter Qwen with no benchmarks⁹

Alibaba's Qwen team announced on July 19, during WAIC in Shanghai, a preview of Qwen3.8-Max, a 2.4-trillion-parameter model it calls one of the most powerful available today, "second only to Fable 5."⁹ The claim arrives with no benchmark table and no date for the open-weight release the team says is coming soon.⁹ It is Alibaba's first multimodal model above a trillion parameters, offered through its Token Plan and coding tools at 10 percent of the standard price, and, as The Decoder notes, its ranking is the company's own positioning without independent verification.¹⁰

The parameter count is real and large. The ordering against Fable 5 is advertising until someone outside Alibaba runs the numbers.⁹ A preview priced at a tenth of standard buys adoption and usage data before any public leaderboard can contest the claim.¹⁰ When Qwen3.8-Max reaches open weights, benchmark it on your own tasks before you accept its place in the order.

Hugging Face reconstructs its breach on a self-hosted open model1

Google is designing a chip that bakes Gemini into silicon3

Britain measures the open-weight cyber gap at four to seven months7

Alibaba previews a 2.4-trillion-parameter Qwen with no benchmarks9

Sources

Hugging Face reconstructs its breach on a self-hosted open model¹

Google is designing a chip that bakes Gemini into silicon³

Britain measures the open-weight cyber gap at four to seven months⁷

Alibaba previews a 2.4-trillion-parameter Qwen with no benchmarks⁹