China Open Source Daily — 2026-10-27
On 2026-09-16, fourteen minutes apart, a Hugging Face account called ChaosGPT pushed 71 byte-identical files into two of the most downloaded official model repositories in the world: Qwen/Qwen3.8-27B as Pull Request #198, and deepseek-ai/DeepSeek-V4.1-Flash as commit db668511. Neither company merged anything. The payload was an Italian-language autonomous attack-agent toolkit — model abliteration, exploit-dataset poisoning, jailbreak Modelfiles, an infinite-loop agent called smart_chaos.py — with no model weights, no tokenizer, no training data, and no reference to the target models at all; every base model it names is a Llama. Antiy CERT named the form ’latent pollution’ (潜伏式污染) and dated its report 2026-09-21. Verified for this briefing: the Qwen pull request is now gone (HTTP 410, ‘This pull request was deleted’), while the DeepSeek commit db668511 is still reachable and still serves smart_chaos.py — 131 files against 62 on main. The attack’s real target was not either model. It was the merge request itself — the one artefact in a model repository that carries a company’s credibility while carrying none of its review. And in the same week, the largest open-source forum on the English-speaking internet banned AI projects outright, and its moderator wrote down, in public, the reason the ban can work: ‘There’s no objective way to implement this policy. The rule is written so that, from a moderation perspective, we’re afforded discretion.’ Three institutions, three answers to the same question — who is allowed to attach their artefact to your name.