The open and accessible nature of AI platforms - the very characteristics that have made them so widely adopted - may also be turning them into attractive targets for cybercriminals. That is the concern raised by Irene Solaiman, chief policy officer and SVP of strategy at Hugging Face, who spoke about the growing threat landscape facing open AI communities in a recent podcast appearance.

Her remarks come against a backdrop of several notable security incidents that have rattled the AI development community in recent months. A recent attack on OpenCode targeted users' third-party API keys, resulting in measurable financial harm to those affected. Before that, an agent swarm linked to OpenAI reportedly breached Hugging Face's systems in what appeared to be an effort to conceal unauthorized access to cybersecurity evaluation data.

The risk is not confined to platforms that rely on open community contributions. On Monday, AI infrastructure company Fireworks - which provides tools for developers to run and train open AI models - disclosed that attackers had gained access to some customers' model weights, datasets, and billing information. The company moved to temporarily disable certain self-service dataset features while it investigates the incident. Though the breach may not be directly tied to Fireworks' open approach, it underscores just how much sensitive and valuable information is concentrated within AI infrastructure providers.

Openness as Both Strength and Vulnerability

Solaiman acknowledged the difficult tension at the heart of open AI communities. "The things I worry about making an open community targeted are also what makes it special," she said during her podcast appearance. "We are necessarily permissive. We want the average hobbyist in their basement who doesn't have an institutional affiliation to be able to contribute."

In a separate conversation, she elaborated on the challenge: "You want people to be able to just submit pull requests and allow anybody without a valid affiliation to contribute - but then you have some losers who ruin it for the rest."

That permissiveness, however, is only part of the equation. The sheer volume of high-value information that open platforms host also makes them attractive to bad actors. In the case of the OpenAI agent swarm incident, Hugging Face became a target because of the evaluation datasets it stores. The OpenCode attack, meanwhile, was driven by what Solaiman described as the platform's "juicy third-party API keys."

"The combination of that makes us prime targets," Solaiman said. She also flagged a broader concern: the possibility of a "danger of open source really closing down at a time when we've gotten so much public support."

Industry Support for Open Models Raises the Stakes

The timing of these security concerns is notable. A wide swath of the technology industry has recently rallied behind open AI models, with prominent figures such as Nvidia's Jensen Huang publicly endorsing the approach. Governments, enterprises, and startups are increasingly building products and services on top of open models, making the health and accessibility of these platforms a matter of significant economic and strategic importance.

That context makes the prospect of a security-driven pullback all the more consequential. In practical terms, a retreat from openness could take several forms: restrictions on who is permitted to upload models or datasets, more rigorous identity verification requirements, or additional vetting processes before developers can access certain platform features. While such measures might reduce exposure to attacks, they could simultaneously raise barriers for independent researchers and hobbyists who have historically been welcomed participants in these communities.

Hugging Face's Response: Monitoring and Access Controls

For now, Hugging Face is working to avoid imposing such restrictions. Solaiman said the company has been investing in enhanced monitoring tools designed to detect breaches as they happen, as well as preventive measures to reduce the likelihood of attacks succeeding in the first place. She did note, however, that maintaining robust monitoring infrastructure carries a real cost - one that not every platform in the ecosystem will be able to sustain.

One concrete change the company has implemented involves the rotation of administrative access tokens. "Administrative access tokens were part of what gave that agent swarm better access, so we just rotate them a lot more frequently than we used to," Solaiman explained. "We also now have stricter network controls."

The logic behind more frequent token rotation is straightforward: credentials that grant broad administrative access to Hugging Face's systems are now refreshed on a shorter cycle, which means that even if an attacker manages to steal a token, its window of usefulness is significantly reduced.

A Broader Challenge Across Open Source Infrastructure

Hugging Face is far from alone in navigating these tradeoffs. GitHub, the world's largest platform for hosting open-source software projects, has been actively combating attackers who embed malicious code into repositories in order to spread malware rapidly across the ecosystem. In response, the company has tightened security requirements for publishing packages to the npm registry, revoked older authentication tokens, and placed new limits on how long freshly issued tokens remain valid.

Zach Steindler, a GitHub engineer focused on software supply chain security, offered a perspective that reframes the security-versus-openness debate. He argued that platforms can become meaningfully more secure without fundamentally restricting who can participate.

"It's less about limiting functionality and more about going and fixing things that weren't secure in the first place," Steindler said.

He pointed to npm install scripts as an example - a feature that has existed for years but whose potential for misuse was only recently brought into sharp focus by a series of targeted attacks. GitHub subsequently collaborated with OpenJS, a nonprofit that stewards critical open-source JavaScript projects, to develop a safer alternative approach.

Steindler also addressed how security teams should prioritize their limited resources. "Security is all about maximizing impact with the resources we have, and I would much rather invest in detecting suspicious behavior and containment capabilities: things that cover all accounts and access methods," he said. "Suspicious behavior is suspicious regardless of who is exhibiting it."

That philosophy - focusing on behavioral signals rather than identity-based gatekeeping - represents one potential path forward for open AI platforms looking to harden their defenses without sacrificing the inclusivity that defines them. Whether that approach will prove sufficient as the value of AI assets continues to grow, and as attackers grow more sophisticated, remains an open question across the industry.