Hugging Face's breach investigation blocked by commercial LLM safety guardrails

While investigating its July 2026 breach, Hugging Face tried analyzing attack logs with a frontier model from a commercial provider. The provider's safety guardrails blocked the forensic work, flagging the attack-log content as policy-violating. Hugging Face switched to a local in-house model, completing analysis without shipping sensitive telemetry to a third-party API.