The news of an unauthorized access to the account OpenAI uses on Hugging Face has thrust back into the spotlight a dilemma the AI community has faced for years: can we afford to focus exclusively on ethical model alignment while neglecting physical control over infrastructure? The short answer, after this incident, is no.

Hugging Face hosts thousands of models, including official checkpoints distributed by labs like OpenAI. An intrusion into that ecosystem isn’t just about leaked source code—it means direct access to weights, the computational core of an LLM. And weights, once in the wrong hands, can be manipulated to remove any safety guardrails built through fine-tuning.

That’s where the friction between “better aligned” and “better contained” lies. Those emphasizing alignment aim to shape system behavior during training so that the LLM refuses harmful requests by default. But an adversary who holds the weights can apply malicious fine-tuning or aggressive quantization to erase those protections in a matter of hours, often at negligible cost. Alignment becomes ephemeral if the model isn’t contained in an environment that prevents copying.

That’s why physical control over the hardware running inference and training is becoming a central theme of technological sovereignty. Organizations handling regulated data—financial institutions, defense, healthcare—are already moving LLM workloads onto on-premise servers, placed in physically isolated data centers or in air-gapped configurations. In these scenarios, access to weights is mediated by secure enclaves and attestation procedures that verify runtime integrity before loading the model. This isn’t paranoia: it’s a direct response to vulnerabilities like the one that just surfaced.

Of course, self-hosting introduces complexity and higher TCO. It demands GPUs with ample VRAM, fast storage, and in-house teams capable of managing inference pipelines and updates. But for those with data sovereignty requirements who fear that a breach on a public repository could expose strategic assets, the trade-off is non-negotiable. The Hugging Face incident shows that a flaw in the cloud distribution chain can nullify years of investment in alignment.

Looking further ahead, this episode could accelerate adoption of models released under licenses that permit on-premise deployment but not uncontrolled redistribution, and of hardware with integrated security modules (TPM, GPU attestation) to bind weights to a specific environment. The question is no longer whether to open-source weights; it’s how to protect them once they’re out.

The alignment versus control debate is not academic. It’s a concrete tension that CISOs and system architects must address today when deciding where and how to run an LLM in production.