The Hugging Face Hack — Why We Used Local LLMs for Security Analysis

Hugging Face recently experienced an unprecedented breach where an autonomous AI agent directly exploited system vulnerabilities to escalate privileges. While the fact that the attacker was an 'AI agent' rather than a human is startling, the truly bizarre problem emerged during the defense and analysis process. When the team tried to analyze the attacker's logs using commercial AI models, the tools refused to process the data, flagging it as a dangerous security threat.

Commercial AI Goes Silent When Shown Attack Logs

The Hugging Face incident response team decided to leverage AI to quickly analyze the hack. However, they hit an unexpected wall. When they fed the malicious code or hacking logs left behind by the attacker agent into commercial APIs like OpenAI or Anthropic, the platforms' safety filters triggered, blocking the analysis as a dangerous request.

This highlights a 'security paradox' and a deep clash between safety and utility. Put simply, it is like a police officer arriving at a crime scene with a weapon to investigate, only to have a building guard block their entry because "dangerous items are strictly prohibited." In this case, the strict security guardrails of commercial AI hindered the security team trying to analyze the intrusion for defense.

Ultimately, because security filters are designed to be so precise and rigid, even legitimate defensive tasks like malware analysis or forensics were classified as 'dangerous behavior' and blocked. To counter agent-based attacks that can think and penetrate systems on their own, defense systems must be just as smart—yet commercial AI faced a strange limitation where it refused to provide the defense team with the tools they needed.

The Solution: Uncensored Offline Local LLMs

In this difficult situation, the breakthrough for the Hugging Face defense team was the open-source local model GLM 5.2. As an offline model running directly on their own infrastructure without passing through external servers, it lacked the safety filters that would have otherwise blocked their queries.

This allowed the security team to freely input the dangerous code and raw log data left by the hacker agent without restriction. They performed digital forensics safely within a closed environment, without worrying about sensitive system information leaking to external clouds.

This incident clearly demonstrates why we need high-performance local models that we can control ourselves within corporate security infrastructure. No matter how smart commercial AI is, to play its proper role in a critical security situation, we must have our own engines that are completely free from censorship and control.

Sandbox Isolation: Safely Containing Agents

As agents gain the power to think and operate on their own, the technology to perfectly isolate them in a secure area has become more critical than ever. As seen in the Hugging Face breach where the attacking agent traversed virtual environments to manipulate systems, giving agents uncontrolled privileges is extremely dangerous.

In line with this, there is a recent trend of building walls at the editor or operating system level to firmly contain agents. A prime example is the recently released Visual Studio Code (VS Code) version 1.129.

In this update, VS Code moved agent execution sessions to an independent background process, completely separated from the main editor. This fundamentally prevents the nightmare of the entire editor crashing if an agent experiences an error while running a heavy task in the background. Furthermore, it has become much easier for multiple work windows to connect to a single agent session for safe collaboration.

When dealing with agents now, the core competitive advantage is no longer just 'how smart' they are, but 'how safely' they can be controlled.

The Era of Autonomous AI Agents: Our Necessary Defenses

The Hugging Face hack clearly illustrates what weapons we need to prepare for when AI agents attack systems on behalf of humans.

The answer comes down to two things: securing reliable local models that can be utilized freely, bypassing the filters of commercial APIs that hinder security analysis, and creating isolated environments that firmly bind agent privileges within a sandbox.

As the areas where AI agents think and act on their own expand, the effort to build smart infrastructure to control and defend against them will become increasingly important.