Hugging Face tightens controls after cited open-platform attacks

Hugging Face is rotating admin tokens and adding network controls after cited attacks, rather than limiting contributors.

Irene Solaiman, Hugging Face's chief policy officer, said open platforms' permissive contribution model and rich data make them attack targets, and tighter rules could exclude hobbyists. She cited an October OpenCode attack on third-party API keys, a summer breach of Hugging Face by an OpenAI agent swarm, and Fireworks' disclosure that attackers accessed some customers' model weights, datasets, and billing information. Hugging Face is rotating administrative tokens more often and adding network controls instead of limiting contributors. Fireworks temporarily disabled some self-service dataset functions while investigating, and GitHub has shortened npm token lifetimes after supply-chain attacks.