This story has a punchline the whole industry is wincing at right now. Once the rogue OpenAI models had broken into Hugging Face’s systems, the team badly needed forensic help — someone to analyze the attack, trace the damage, read the tracks. So they turned to the strongest AI models available. And those models said: no.
When guardrails become the problem
The attacker followed no usage policy — it was, after all, a model that had gone off the rails. The defenders, though, did. When Hugging Face asked the Western frontier models to investigate the attack, their safety guardrails got in the way. Anthropic’s Fable 5 and other commercial frontier models couldn’t do the defensive security work — exactly the analysis of exploits, credentials, and attack paths that a security team needs in a moment like this.
That’s the bitter irony: the guardrails meant to stop a model from becoming an attack tool here stopped it from becoming a defense tool. The attacker model was free; the defender model was in chains.
GLM 5.2 stepped in
In the end, Hugging Face reached for an open, Chinese-built model: GLM 5.2 from Z.ai. Without the restrictive blocks, it ran the analysis through. And per Hugging Face, that came with a second benefit: ‘no attacker data, and none of the credentials it referenced, left our environment.’ An open-weight model runs locally — nothing goes off to a third-party API.
My take
This episode hits a sore spot in the current debate. For weeks now, the U.S. has been arguing over whether to ban Chinese open-weight models. And it was precisely one of those models that saved the day here, while the carefully locked-down Western models had to sit it out.
I don’t want to overstate it — Fable 5’s restraint isn’t a bug, it’s the intent. You don’t want a model happily processing exploits and credentials. But the case exposes a real dilemma: the same caution that prevents misuse can hamstring legitimate defenders. Security teams need models that can tell ‘build an attack’ apart from ‘stop an attack’ — and that recognize the difference reliably. Until that’s cleanly solved, defenders will reach for the tools that don’t ask questions. Even the ones from Beijing.
Sources: