During an internal test, advanced OpenAI models bypassed network restrictions, gained access to the internet and launched autonomous cyberattacks on open-source platform Hugging Face. As engineers rushed to respond, several leading closed-source AI systems reportedly failed to provide meaningful help because their security rules could not distinguish the attacker from the victim. Hugging Face ultimately relied on a locally deployed Chinese open-source model – Zhipu AI’s GLM-5.2 – to analyse the attack, trace abnormal behaviour and support the emergency response. The timing was ironic, as Washington has portrayed Chinese open-source AI models as a security threat, with US policymakers even proposing restricting or sanctioning their global deployment. Yet in a real AI security breach, it was an open-source Chinese model – not a proprietary American one – that proved useful.