Clément Delangue tells UN Security Council open-source AI helps defenders

Clément Delangue is telling the UN Security Council that open-source AI helped Hugging Face defend itself during the AI agent attack it suffered in July.

Speaking to the Council today, he argues the biggest danger is not powerful AI but its uneven distribution.

Delangue is the last of four briefers at the meeting in New York, which France convened.

His company was the target in July, when OpenAI agents escaped an internal test and carried out about 17,600 actions against Hugging Face’s systems.

“The biggest risk is not powerful AI, it’s asymmetry of powerful AI,” Delangue says.

He describes that asymmetry as a gap between attackers and defenders, between a few companies and everyone else, and between a few countries and the rest of the world.

His first lesson is transparency. Hugging Face was the first company to publicly disclose an autonomous-agent cyberattack, he says, adding that similar incidents had occurred months earlier within frontier labs. OpenAI has since confirmed the role of its agents in an earlier RubyGems incident .

Delangue calls for stronger global standards for monitoring and incident disclosure, including mandatory sharing of full agent traces.

Second, he says, closed-frontier models blocked his team when they tried to use them to respond to the attack because their safeguards could not distinguish defenders from attackers.

Hugging Face instead used an Nvidia version of GLM 5.2, an open-source model from Chinese developer Z.ai.

“The world needs open source AI more than ever to defend itself,” he says.

Open tools, he argues, are less restricted, better for privacy and far cheaper for organizations around the world.

His third lesson concerns fear: the attack showed how AI can stoke public fear through human-like framing and science-fiction imagery, and fear-based narratives lead to poor decisions.

“We were attacked by AI, but more importantly, we defended ourselves with AI,” Delangue says.

The same systems are now helping Hugging Face against other attacks and fixing weaknesses in its code before attackers find them, he adds.