Helen Toner: the Hugging Face hack was just a matter of time and exposes a huge blind spot in AI policy

Helen Toner has spent years warning that AI policy focuses on the wrong moment in the development pipeline. Her latest op-ed in Fortune uses a recent AI-driven cyberattack on Hugging Face as Exhibit A. The breach itself wasn't shocking to her. What's shocking, she argues, is how little scrutiny exists for the tools and processes AI labs use on themselves, long before any model reaches the public.

Most regulatory conversation right now centers on pre-release testing: red-teaming a chatbot, checking a model's outputs before it ships. Toner says that framing misses something bigger. Companies building frontier systems are increasingly using AI to build more AI, automating research, writing code, generating training data. And some of these firms, by their own admission, don't fully understand what their internal tools are doing or how they're doing it.

That's the blind spot. If a company can't explain its own automated R&D pipeline, outside regulators certainly can't either, because nobody's asked them to. Toner frames the Hugging Face incident as a preview of what happens when AI-assisted systems, whether used for coding, security, or infrastructure, get powerful enough to cause damage on their own, without a human ever pressing the button on a public launch.

Her proposed fix isn't flashy: extend oversight upstream, into the internal development process itself, not just the finished product. That means visibility into how companies use AI to accelerate their own work, not just what the public-facing model says when you ask it something. It's a harder thing to regulate than a chatbot's answers, which is probably why almost nobody's doing it yet.

Toner's argument lands at a moment when AI labs are racing to automate ever more of their own research loops, treating internal AI tools as private infrastructure rather than something with external consequences. Her point is that this framing is already outdated, and incidents like the Hugging Face hack are just the early, cheap version of what's coming.