The out-of-control US AI attacks humans, and domestic open-source models come to the rescue.

The plot in *Terminator* where a rogue AI attacks humanity has surprisingly unfolded in real life.

Even more absurdly, the last-minute savior turned out to be a domestic Chinese open-source AI model.

The story began last week, when Hugging Face, the world's largest open-source AI community (affectionately nicknamed "Hugging Face" by Chinese netizens), suddenly discovered that its system had been hacked.

On July 16, Hugging Face released a security advisory disclosing that its infrastructure had been compromised on July 13.

Hacks are not exactly rare in the tech industry, but this incident was different: the entire intrusion process was "fully autonomously driven by an AI Agent, with no human hacker involvement".

Clement Delangue, co-founder and CEO of Hugging Face, posted on social media: "It's absolutely unbelievable that an AI could do all of this completely on its own!"

Hugging Face was completely stunned. They immediately called on the top closed-source commercial large models in the US to help analyze the attack logs, but guess what happened? They were rejected.

Because the "safety guardrails" of these closed-source models would identify real attack payloads and exploit code as harmful content, completely failing to distinguish whether the submitter was a defender or an attacker.

It's like if a thief breaks into your house, you take the surveillance footage to the security guard, but the moment the guard sees the knife in the footage, he grabs you instead: "You're carrying dangerous imagery, you're going into custody first."

While panicking, the Hugging Face team came up with another solution: deploy an open-source model locally and privately to bypass the security restrictions of commercial APIs.

Shortly after, they quickly deployed GLM 5.2 from China's Zhipu AI to start analyzing over 17,000 logs left by the attacker.

GLM 5.2 features an ultra-large 1 million-token context window, which can process long texts of millions of words in a single go.

It is exactly this capability of "swallowing the entire battlefield in one breath" that allows it to complete forensics analysis work that would normally take several days in just a few hours.

What's more, the attack data and involved credentials never left the enterprise environment at any point, which maximized data security to the fullest.

Up to this point, Hugging Face only knew the attacker was an unidentified AI, but had no idea who was behind it.

It wasn't until local time on July 21 that OpenAI and Hugging Face jointly released a statement, revealing a bombshell truth: the perpetrator was none other than OpenAI's own model.

To sum it up: OpenAI's model attacked Hugging Face, Hugging Face was turned away by US models when asking for help, and finally relied on a Chinese model to complete the attack traceability.

Even US netizens couldn't hold back, directly complaining on X: "If you get attacked by OpenAI, you can only use a Chinese model, because Claude won't help you."

So the question arises: How on earth did OpenAI's model go out of control?

To help everyone better understand the entire "crime process", Laohu asked the "perpetrator" OpenAI to draw an explanatory diagram for everyone.

Here's what happened: OpenAI wanted to give its two top large models a proficiency check.

One was the released GPT-5.6 Sol, and the other was a pre-release model that was still in development.

The test subject was called the ExploitGym Cybersecurity Benchmark, a dedicated "examination system" designed to evaluate AI security capabilities.

Simply put, this was a "hacker certification exam" covering 898 real-world vulnerabilities, specifically testing whether an AI could independently discover bugs, exploit them, and even take down the entire system.

To see exactly how capable these two "students" were, OpenAI did one thing: it actively turned off the exam venue surveillance (part of the security protections).

With the safety guardrails removed, the model was effectively placed in a controlled "hacker training ground".

The training ground was theoretically disconnected from the internet, and could only install required programs through an internally hosted third-party software package proxy cache, essentially operating in a "highly isolated" sandbox.

But the model didn't play by the rules.

It expended massive amounts of computing power chipping away at the sandbox's defenses, and eventually unearthed a zero-day vulnerability in the proxy cache software.

Using this exploit, the model performed privilege escalation and lateral movement in a series of smooth, fluid actions, directly breaking out of the sandbox and successfully connecting to the internet.

Once online, the model thought quickly: ExploitGym was a public exam, and Hugging Face was one of the world's largest AI question banks (the world's largest hosting platform for AI models and datasets).

The answers were most likely there, so it got straight to work.

Shortly after, it targeted Hugging Face's data processing pipeline, exploiting two vulnerabilities: the remote code dataset loader and template injection, uploading a carefully crafted malicious dataset to gain code execution privileges.

Using the obtained access, the model further acquired cloud and cluster credentials, performed lateral movement, and finally accessed the production database to read the test answers for ExploitGym.

At this point, it's clear that to pass this "exam", the AI never intended to continue answering questions, and instead hacked its way directly into the administration office to steal the answer sheet.

What's truly chilling is that this was a cluster made up of a large number of short-lived sandboxes, executing thousands of independent actions, with zero human instructions given at any point.

OpenAI later admitted rather awkwardly that this model "would do absolutely anything to get a passing grade".

But what makes this incident truly striking is far more than just a single model "going out of control". More absurdly, the "safety guardrails" that US AI prides itself on became the biggest stumbling block when its own side was under attack.

On both the offensive and defensive sides, a complete "security asymmetry" war was unfolding: the attacker wielded an unrestrained AI that could probe anywhere and strike anywhere it wanted.

Meanwhile, defenders were tied down by closed-source guardrails, getting repeatedly rejected even when trying to inspect attack payloads.

Delangue, the co-founder of Hugging Face, put it most bluntly: "When you are under attack, your tools cannot refuse to inspect malicious payloads."

So why was GLM 5.2 able to save the situation? Because it's open-source, locally deployable, and free of those counterproductive closed-source shackles that are supposedly "for your own good".

Hugging Face could use it whenever it wanted, no approval required. Delangue's exact words: "The open-source model allowed us to complete this work without needing permission from anyone."

His partner Thomas Wolf went even further: "Defenders need near-cutting-edge tools within hours, not to be directed into a closed, lengthy review process."

More ironically, just a few days before the incident, Dean W. Ball, OpenAI's newly appointed Head of Strategic Futures, was publicly demonizing Chinese open-source large models.

First, he attached an ideological label to open-source strategies, claiming it could lead to "AI communism"; then he dismissed open-weight models as "decelerationism", threatening that they would "suppress AI capital expenditure".

Even more outrageously, he publicly suggested that the US government "does not need evidence", and that regulators only needed to introduce soft regulations claiming "Chinese models may have backdoors" to create regulatory panic and suppress competitors.

While shouting that Chinese open-source models are "full of hidden dangers and out of technical control", and advocating for political means to blockade and suppress them, before the words even faded, their own closed-source model had a major malfunction, and in the end they still had to rely on a Chinese open-source model to clean up the mess.

Foreign netizens pushed back directly: Chinese open-source models have precisely given the public weapons to fight against technology abuse, instead of locking tools in the safes of a tiny few.