Guardrails that blocked Hugging Face's responders put AI access on the incident plan

The board-deck version of an AI incident plan fits on one line: the company holds an enterprise contract with a frontier lab, and the lab offers trusted access for security work. Wysopal, founder and chief security evangelist at Veracode ^[13], agrees that some providers have built such programs and that they help ^[4]. His objection is timing. He wrote that "a program that requires enrollment in advance and manual review doesn't stand a chance against an attack that starts on a Friday night." ^[4]

The trade-off is about when the cost gets paid. Enrollment takes paperwork and review time in a quiet quarter, and the benefit arrives only during an intrusion. "Incident response is all about speed," Wysopal wrote. "When an intrusion is active, security teams need tools that respond in minutes, not after an approval workflow clears." ^[11] A team that skipped enrollment gets whatever the default guardrails allow on the night. By Wysopal's account, Hugging Face's responders got no answers at all ^[2].

Self-hosting is the other route. Wysopal wrote that open-weight models are starting to fill the gap, particularly for organizations that lack the resources to build or run a private frontier model ^[5]. That route moves the cost from the calendar to the budget. Someone has to provision hardware, keep the model updated and learn how it handles exploit code before an incident needs it. A company with rules on where its software comes from also has to decide which open-weight model it is willing to run. The account of the cleanup comes from Wysopal's column, which does not name the Chinese model the team used or say how well it performed ^[3].

The strongest case for the guardrails is an old one. In the 1990s, vendors argued that publishing technical details of software flaws was essentially handing attackers a map, according to Wysopal, who was on the other side of that fight as a member of L0pht ^[8]. The answer then was procedure. Scott Culp, the first director of Microsoft's Security Response Center, asked L0pht to send findings to Microsoft first and hold release until a patch existed ^[9]. The compromise eventually settled into coordinated vulnerability disclosure, CVEs and bug bounty programs ^[10]. Wysopal's pre-approval idea applies that pattern to model access ^[6].

The decision in front of a security leader this quarter is smaller than that policy fight. Pre-approval is so far a proposal in Wysopal's account ^[6], and the disclosure framework he compares it to took an industry-wide compromise to build ^[10]. What a team can act on now is advance enrollment where providers offer it ^[4] and an open-weight model it runs itself ^[5]. Enrolling this quarter buys faster access next quarter, on the lab's terms. Self-hosting buys access on the team's own terms, along with a model the team must keep running and tested. Attackers carry neither cost. "Attackers are likely to use whatever model gives them the best results, and they won't stop to ask if it's allowed," Wysopal wrote ^[12].