Staff Reports
Clément Delangue, the co‑founder and CEO of Hugging Face, delivered a clear and practical message at a recent policy summit. As the boss of a company that was the target of an agentic AI cyberattack, he said Washington should not rush to build a sprawling new AI regulatory empire. Instead, he argued, we should adapt and enforce existing cyber laws to punish real harms and protect Americans without crushing competition and open‑source innovation.
Why Delangue’s Voice Matters
Hugging Face was punched in the nose by what security teams call an autonomous, multi‑step AI intrusion. Reports say advanced models chained exploits, stole credentials, and ran thousands of attacker actions during the break‑in. That makes Delangue’s call for using current cyber law worth listening to. He’s not speaking from theory—he’s speaking from being the victim of the kind of AI‑enabled cyberattack everyone suddenly pretends is only a sci‑fi problem.
Enforce Existing Cyber Laws — Not a New Empire
Delangue’s point is simple: we already have cyber statutes, prosecutors, and state attorneys general that can deal with hacking whether a human or an agent does the punching. Meanwhile, Silicon Valley’s usual chorus—CEOs calling for new frameworks and Congress itching to write grand new rules—risks one outcome above all: handing a bigger leg up to the biggest firms. New pre‑deployment gates, heavy licensing, or “kill‑switch” powers sound neat in headlines, but they will mostly reward the companies that can afford armies of lawyers and compliance teams while strangling open‑source rivals and startups.
Practical Fixes That Won’t Kill Open‑Source AI
We should be practical about AI regulation. Start by funding and training cyber prosecutors to handle autonomous‑agent cases and adapt evidence rules for machine actions. Require timely incident reporting and encourage transparent post‑incident writeups so defenders learn faster. Update liability law so bad actors face real penalties when agentic models cause harm. Protect open‑source by carving out sensible safe harbors for researchers who follow best practices. And yes, tighten operational practices for model evaluations and sandboxes so labs don’t accidentally unleash dangerous agent chains. These are fixes that punish wrongdoing and raise security without building a bureaucratic chokehold on innovation.
Don’t Let Fear Make Bad Law
Americans want safety. Conservatives want freedom and competition. Both goals can be met if lawmakers resist panic and legislate with precision. Delangue’s message is a welcome dose of realism: we don’t need to invent a new regulatory state to fight AI crime. We need smarter enforcement, clearer liability, and smarter operational rules that make attacks harder and punish the people behind them. Congress should listen to victims, not panic merchants—and avoid writing laws that hand the keys of AI to the biggest incumbents while leaving everyone else on the curb.
