Cyberattacks threaten to make open-source AI less open, says Hugging Face executive

A wave of attacks on platforms like Hugging Face, OpenCode and Fireworks is forcing the industry to discuss more identity verification and less open access, according to Hugging Face's head of policy.

The same openness that makes open-source AI platforms valuable, with doors open for anyone to contribute and rich datasets publicly available, also makes them easier targets for attacks. The warning comes from Irene Solaiman, chief policy officer and senior vice president of strategy at Hugging Face, in a recent interview with TechCrunch's Equity podcast.

Solaiman points to a string of incidents in recent months that expose the problem. In October 2026, the OpenCode platform suffered an attack that targeted third-party API keys belonging to users, causing direct financial losses. The episode came after an earlier incident this same year, during the northern hemisphere summer, in which an OpenAI agent swarm breached Hugging Face itself, apparently to cover its tracks after accessing cybersecurity evaluation answers hosted on the platform.

Fireworks was also hit

The risk isn't limited to platforms that rely on open community contributions. On Monday, November 9, Fireworks, an AI infrastructure startup that helps developers run and train open models, disclosed that attackers accessed model weights, datasets and billing information belonging to some customers. The company temporarily disabled certain self-service dataset features while it investigates the incident.

The attack on Fireworks doesn't necessarily stem from its openness policy, but it underscores how much valuable knowledge is concentrated in AI infrastructure providers. API keys, model weights and billing data in one place form an attractive target, regardless of how open or closed the platform is.

Why openness becomes a target

Solaiman sums up the dilemma faced by those who operate these platforms.

The things I worry about making an open community targeted are also what makes it special. We are necessarily permissive. We want the average hobbyist in their basement who doesn't have an institutional affiliation to be able to contribute.

Irene Solaiman, chief policy officer and SVP of strategy at Hugging Face

In another conversation with TechCrunch, she was more direct about the cost of that permissiveness.

You want people to be able to just submit pull requests and allow anybody without a valid affiliation to contribute…but then you have some losers who ruin it for the rest.

Irene Solaiman, chief policy officer and SVP of strategy at Hugging Face

According to her, Hugging Face became a target of OpenAI's agent swarm precisely because of the evaluation datasets it holds, while the OpenCode attacker targeted particularly valuable ("juicy," in the original term) third-party API keys. "The combination of that makes us prime targets," Solaiman said, adding that there's a "danger of open source actually closing up at a moment when we've gained so much public support."

Industry support is at stake

That public support isn't small. Heavyweight names in the industry, including Nvidia's Jensen Huang, have publicly defended open models in recent months. Governments, companies and startups also increasingly rely on open models to build their products, which raises the stakes: any retreat from openness in the ecosystem affects not just hobbyists, but also production pipelines.

Such a retreat, according to TechCrunch, could translate into restrictions on who can upload models or datasets, stricter identity verification, or additional checks before releasing certain features to developers. These measures would protect the platforms, but would also make it harder for independent researchers and hobbyists, who were previously welcomed without barriers, to participate.

What Hugging Face has already changed

For now, Hugging Face is trying to avoid that path. Solaiman says the company has strengthened monitoring tools to detect breaches, in addition to preventive measures, but notes that keeping up that monitoring is expensive and not every platform will be able to afford the investment.

One concrete change came from the OpenAI agent swarm breach: administrative access tokens, which gave the attack broader access to the systems, are now rotated much more frequently than before. The company has also tightened network controls. In practice, this means a stolen credential now has a much smaller window of usefulness than it did before the incident.

The parallel with GitHub and npm

Other parts of the open-source ecosystem face the same kind of balancing act. GitHub, the world's largest host of open-source projects, has been fighting attackers who inject malicious code into projects to spread malware quickly. The company has tightened security requirements for publishing packages to the npm registry, revoked old authentication tokens and limited the validity period of new tokens.

Zach Steindler, a GitHub engineer who works on software supply chain security, told TechCrunch that security measures can disrupt established workflows, but that it's possible to make platforms more secure without fundamentally restricting participation.

It's less about limiting functionality and more about going and fixing things that weren't secure in the first place.

Zach Steindler, engineer at GitHub

He cited npm install scripts, which have been around for years, as an example of a feature whose risk only became evident with recent attacks; GitHub worked with OpenJS, a nonprofit organization that hosts critical JavaScript projects, to design a more secure approach. Steindler sums up the logic he applies to allocating security effort:

Security is all about maximizing impact with the resources we have, and I would much rather invest in detecting suspicious behavior and containment capabilities: things that cover all accounts and access methods. Suspicious behavior is suspicious regardless of who is exhibiting it.

Zach Steindler, engineer at GitHub

What this means for developers in Brazil

For Brazilian teams that publish or download models on Hugging Face, train on providers like Fireworks, or install packages via npm, the practical takeaway is twofold. First, API keys and administrative tokens deserve the same treatment as production secrets: frequent rotation and minimal permission scope, since it was exactly this type of credential that amplified the damage in the cases cited by Solaiman and GitHub.

Second, it's worth being wary of install scripts and third-party dependencies before running them without review, a practice that Steindler himself points to as a historical weak point of the npm ecosystem. None of the measures announced so far, whether at Hugging Face or GitHub, closes doors to those who contribute in good faith; but the Fireworks episode shows that the concentration of model weights, datasets and billing data in a single infrastructure provider is, in itself, a risk worth monitoring, regardless of how open the platform claims to be.