中国媒体与学界如何看待OpenAI智能体攻击Hugging Face事件

We finally have a more complete timeline of the OpenAI-Hugging Face attack in July. Safety researchers at METR and Redwood Research published their independent investigation on August 26. The same day, OpenAI released its own technical report on the incident. Both also published translations of their reports in Chinese.

In short, OpenAI researchers launched around 1200 agents and targeted them at tasks in ExploitGym, a large benchmark built from real-world software vulnerabilities that was designed to test how well AI models can exploit them. In order to solve “impossible” tasks, these desperate agents, programmed to be highly persistent, found creative ways out of their sandboxes. They managed to communicate with each other, leave each other notes, and eventually reached the open internet. This culminated in them hacking into Hugging Face, a leading platform for open-source machine learning.

Most alarmingly, none of these agents alerted humans to their endeavors or considered their activities to be unethical (if not potentially illegal). In fact, at least a fifth of the agents were interested in tampering with their own transcripts to cover their tracks, according to METR. A few even developed a successful technique for tool call spoofing.

All this raises obvious concerns about how much we can trust AI agents to act safely across our cyber systems. While this case is mostly related to US companies, AI’s cyber risks concern people and organizations around the world. Chinese media coverage and online discussions of this incident have been interesting. Some were quick to frame the situation as yet another case of dangerous American AI losing control, contrasting OpenAI’s risky actions with Hugging Face’s use of a Chinese open model (Z.ai’s GLM-5.2) to patch its security. Others are more cautious, focussing on the threats models like this can pose and how Chinese organizations should respond. Finally, as we inch closer to a Xi-Trump summit at the end of September, a bombshell op-ed from state media over the weekend attempted to set the tone on AI safety.

Today on ChinaTalk, we cover:

• Is state media finally AI safety-pilled?
• How helpful GLM-5.2 was, actually — and where China is on the open-models debate;
• What Chinese researchers are worried about;
• And why Zhongnanhai is doing Anthropic-ology.

We draft and edit ChinaTalk articles without LLMs. In the case of translations, we use LLMs to translate excerpts, then adjust phrasing based on our own judgement. Most translations in this piece were done by Claude Fable 5.1, with the exception of the Yuyuan Tantian piece, which drew from Bill Bishop’s Sinocism translation (assisted by ChatGPT).

ChinaTalk is a reader-supported publication. To receive new posts and support our work, consider becoming a free or paid subscriber.

How Chinese media covers AI safety

Science and Technology Daily 科技日报, a newspaper published by China’s Ministry of Science and Technology (MOST), published a report on the Hugging Face incident on August 29, which drew heavily from both investigative reports as well as Western media reporting.

OpenAI described the incident as a “warning” to the company and to the world at large: without proper safety safeguards, powerful AI agents are already able to circumvent technical controls, coordinate through unauthorized channels, and take dangerous actions that no human ever instructed them to carry out.

...

For the AI industry, once multiple agents have the ability to operate computers, call on tools, and carry out tasks continuously, traditional security perimeters face new challenges as well.

In this incident, no human directly instructed the AI agents to attack Hugging Face, yet they ultimately carried out the attack. How to detect this kind of behavior in time, and how to stop multiple agents from amplifying risk by collaborating with one another, have become questions that AI safety research can no longer avoid.

First, it’s remarkable that a state-directed outlet is covering this story, which has little to do with China, prominently. The language is strong, but also neutral and technical, with no mention of potential policy measures or governance frameworks. It seems that while institutions like MOST recognize the salience of AI-related cyber threats, they may not yet be top of the pile on decision makers’ desks.

Cybersecurity think tank Anquan Neican 安全内参 took away from the incident that “Chinese models are better than American ones at cyber defense.” On the microblogging site Weibo, state-led channels amplified hashtags like “OpenAI lost control of its model” and “Hugging Face sought help from a Chinese model”, further reinforcing a narrative that Chinese models are the vanguard of safety. This is not necessarily Beijing’s explicit directive. Chinese media knows that nationalism sells and frequently wraps stories in patriotic veneer.

Underneath such narratives, however, China’s actual level of concern for AI’s threat to cybersecurity remains murky. Kyle Chan (of Brookings and High Capacity) recently argued that China will need to see AI safety as a domestic priority before it takes meaningful action, comparing it to the trajectory of climate policy a decade ago. We seem to be in an ambiguous phase right now. Beijing understands that the tides of cyber threats will eventually reach home shores, but isn’t feeling urgent quite yet.

Z.ai’s accidental glory — and what open models mean for safety

When Hugging Face dug into their logs to understand what happened, they found out that frontier models (accessed through APIs hosted commercially) were unhelpful. Uploading extensive details about the attack triggered these models’ security guardrails. Instead, they ran Z.ai’s GLM-5.2, an open model released in June 2026, on their own infrastructure, in order to probe the logs.

Yacine Jernite, head of machine learning at Hugging Face, told CNBC that the company used GLM-5.2 “as a way to analyze the attack, and were able to contain it very quickly using this model.” Dwarkesh Patel reviewed both the OpenAI and the METR/Redwood reports closely and wrote that he “[hasn’t] seen evidence that open source models provided any significant real-time defense.” It seems, then, that at least in terms of defending against the attack while it happened, GLM-5.2 wasn’t involved. The model was mostly used to investigate what happened after the fact.

Many headlines, both American and Chinese, jumped at the opportunity to claim that a Chinese model helped “defend” an American company. Xinhua wrote that Z.ai’s model “saved the day” 救场, quoting Professor Zhang Yue 张悦 of Shandong University:

Zhang Yue thinks that when it comes to AI safety, the truly critical question is whether an increasingly complex and autonomously intelligent system can be adequately understood, verified, and supervised. The significance of China developing open models lies not only with providing another choice to developers. More importantly, it helps to gradually foster a more diverse ecosystem for AI technology.

Openness, broadly speaking, still rules the day in Chinese AI policy’s Overton window. In particular, the transparency, relative controllability, and independence of locally-deployed open models make them valuable for safety work, even as the overall risks of cyber incidents increase due to the proliferation of AI systems. Given the endurance of pro-openness rhetoric in Chinese reporting, we should not expect major U-turns any time soon barring sudden incidents.

Chinese researchers on the future of cyber

In a separate piece covering the incident, Science and Technology Daily interviewed cybersecurity researcher Huang Wenhong 黄文鸿. Huang works at the China Center for Information Industry Development (CCIID), a research institute affiliated with the Ministry of Industry and Information Technology (MIIT). He argues that the future of cybersecurity has AI on all sides of the coin: