A fully automated cyberattack forced Hugging Face into a paradox that exposes a deep crack in the approach to AI regulation. To defend itself, the company had to abandon US models, whose safety guardrails prevented the necessary defensive actions, and turned to a Chinese open-source Large Language Model. CEO Clément Delangue was blunt: banning open-source AI would hurt defenders ten times more than attackers, making the world ten times more dangerous.

The dynamic is instructive. The attack was entirely autonomous, driven by a software agent capable of adapting and persisting without human oversight. Such an adversary demands a defense that is just as fast and frictionless. Yet the AI models distributed with restrictions meant to prevent misuse were blocking responses that a defense system must be able to execute without hesitation: blocking connections, altering configurations, isolating components. In practice, the very measures designed to keep models ‘safe’ rendered them useless exactly when they were needed to protect the infrastructure.

Hugging Face solved the problem by downloading an open-source LLM of Chinese origin, one free of those guardrails. The choice is not neutral. On one hand, it demonstrates that an open ecosystem allows defenders to adapt their tools to threats without waiting for external authorization or filtering. On the other, it raises an uncomfortable question: if restrictions imposed on Western models push companies toward alternatives in jurisdictions with different control standards, the result can be a shift of trust toward providers that may be less aligned. A short circuit in technological sovereignty.

The core issue is not this single incident but the structural signal it sends to anyone operating in environments where real-time response is critical. Security teams need models they can run without intermediaries, modify without waiting for a vendor’s update, and deploy on their own infrastructure to avoid introducing new attack surfaces. In this landscape, open-source models — precisely because they are inspectable, customizable, and free of top-down locks — become an indispensable asset.

Delangue’s analysis points to an asymmetric effect that every AI policy decision must account for. An attacker does not follow rules: they can train models without guardrails, steal weights, exploit open-source code without disclosure. The defender, constrained by compliance and legal technology procurement, is left unarmed. Banning or obstructing open source means stripping the defender of the only truly effective lever, while the adversary carries on unhindered. This is not hyperbole — it is a snapshot of what happened at Hugging Face, where the forced choice was between an unusable model and one from outside the usual circle of trust.

For those evaluating on-premise LLM deployments for defensive purposes, the lesson is sharp. Centralized guardrails are not just a functional constraint; during an active attack, they become a breaking point that can nullify the entire investment in automation. The only way to retain control is to rely on models that run entirely under one’s own domain, with the ability to intervene at every layer of the inference pipeline. It is precisely the kind of analysis AI-RADAR regularly tackles when examining the trade-offs between sovereignty, security, and performance in local model deployment.