Hugging Face attacked by AI agent
At the time of recording, Hugging Face reported an active incident where an AI LLM agent was being used to probe and attempt to breach their systems.
Snapshot · The a16z Show
Sriram Krishnan on Open Source AI's Biggest Week Yet
Explore episode
Jul 24, 2026
Where this was said
Open-Weight Models & Security: Linus's Law Meets the AI Age
At 18:30 · chapter starts 17:30
Krishnan grew up on open source and is a genuine believer in its security advantages. [1] — Sriram Krishnan "Linus Torvalds said 'given enough eyes, all bugs are shallow.' Sriram Krishnan applies this to AI: open-weight models downloaded from Huggi…" 17:30 He invokes Linus's Law — 'given enough eyes, all bugs are shallow' — to argue that open-weight models are more secure than closed ones because anyone can download them from Hugging Face and inspect every layer. You simply cannot do that with a closed API model. But he immediately counterbalances this with a sobering real-time data point: on the day of the recording, Hugging Face reported an active incident where an AI LLM agent was being used to systematically probe and attack their systems. The uncomfortable irony: the answer to AI-powered cyber attacks is almost certainly AI-powered defense — which requires defenders to have access to the best models. If American frontier model safety guardrails make those models less useful for security work, defenders are already at a disadvantage. [2] — Sriram Krishnan "Hugging Face attacked by AI agent: At the time of recording, Hugging Face reported an active incident where an AI LLM agent was being used …" 18:30
Linus's Law Applied to AI: Open Weight = Inherently Secure
Linus Torvalds said 'given enough eyes, all bugs are shallow.' Sriram Krishnan applies this to AI: open-weight models downloaded from Hugging Face can be inspected by the entire world, making them inherently more auditable than closed frontier models. Security through transparency, not obscurity.
Open-weight models inherently more inspectable
Open-weight models downloaded from Hugging Face can be inspected, fine-tuned, and modified by the entire global community, making them inherently more auditable than closed models.
Distillation Is Not a Scandal — It's How AI Has Always Worked
Every AI model from the original GPT onward was trained by distilling human knowledge from the internet. The controversy around Chinese models distilling from American ones ignores the fact that distillation is foundational to how all models are built — the real issue is the asymmetric legal playing field.
Similar snapshots
AI coding viability debate as hook
The founder attached their SaaS demo to the trending debate about whether AI coding is actually good enough to build a full SaaS product.
Algorithm understanding drove Twitter growth
Quickly forming opinions on how the Twitter algorithm and platform worked allowed the speaker to grow rapidly on the platform.
MVP built in one week
Sam's initial MVP was coded in approximately one week using ChatGPT voice mode and copy-pasting code, with no prior technical experience.
Discord vs email for young users
Sam argues Discord is 10x better than email for building relationships with younger users who rarely check their inbox.
Monthly infra costs ~$780–$980
Sam's monthly operating costs include Cursor ($200), AI image generation ($100), AI video generation ($200), hosting ($100), email marketing ($80), and AI compute ($300–$500).
ChatGPT-powered pain point research
Sam recommends copying days of Discord chat history into ChatGPT and prompting it to list recurring pain points as a fast, free market research technique.
50 free tools built total
Bhanu and his team built approximately 50 free tools to attract search traffic, each linked back to SiteGPT.
New tool built in under 5 minutes
With AI coding tools like Cursor, Bhanu can now create a new free marketing tool in less than 5 minutes by referencing existing tools.
KD filter < 10 for rankable keywords
Bhanu filters Ahrefs keyword results to show only those with a keyword difficulty below 10, making them realistic ranking targets for any decent website.
