I read the HN headline Tuesday morning and did a double-take: “OpenAI says Hugging Face was breached, exposing its pre-release models.” OpenAI. The company whose whole business is other people trusting it with data. Even they can’t keep their crown jewels off infrastructure that gets popped.

And the timing is almost too on-the-nose. The same week, Glow launched with a $1.2B valuation selling endpoint security for AI systems. So one headline says the centralized AI plumbing got breached, and the next says there’s now a billion-dollar market for guarding it. Both are describing the same problem from opposite ends.

The models weren’t even shipped yet

What got me about the OpenAI story is that these were pre-release weights. Not customer data, not logs, not the stuff you’d assume leaks first. The most guarded thing a frontier lab owns, sitting on shared infrastructure, gone.

Now do the substitution. If a lab that treats its model weights like nuclear codes still ends up exposed through a third party, what happens to the far less protected pile of your emails, your CRM exports, and your half-drafted replies that every cloud AI tool quietly ships off to a server somewhere?

What’s actually the attack surface here?

It’s not the model. It’s the pipe.

Every cloud AI product works roughly the same way. You hand your data to their frontend, their frontend forwards it to their backend, their backend stores some of it, logs more of it, and passes it to a model host. That’s four or five places your data lives that you don’t control. Hugging Face was one link in somebody’s chain, and the whole chain caught fire.

I wrote about this in April when LiteLLM got popped and thousands of companies bled credentials through a single compromised proxy. Different vendor, identical lesson. When you centralize everyone’s data and keys behind one door, you’ve built the exact thing an attacker most wants to kick down. A breach isn’t a failure of the pipeline. It’s the pipeline working as designed, for the wrong person.

Your tab never leaves the building

Here’s the part that took me an embarrassingly long time to appreciate, because I’d assumed all AI tools had to route data through the vendor’s cloud to be useful, and it turns out that assumption is just wrong for a whole category of them.

A browser agent like Dassi lives in your browser’s side panel. It reads the page you already have open, in the tab you’re already logged into, on the session you already authenticated. When it needs a model, the request goes from your machine straight to whichever LLM you picked. There’s no Dassi server in the middle holding your Gmail thread. There’s no shared vault of a million users’ data that becomes worth breaching. The page content and your login state stay local because there was never an architectural reason to move them.

So when the next Hugging Face happens, and there will be a next one, the question that matters is: what of yours was sitting on the thing that got breached? For a local browser agent, the answer is close to nothing. You can’t leak a database of user data you never built.

BYOK doesn’t stop the breach. It shrinks the blast radius.

BYOK won’t make your LLM provider un-hackable. Nothing will. What it does is collapse the number of parties holding your keys from “every SaaS tool between you and the model” down to you and the provider you chose. No proxy. No aggregator. No convenient central honeypot.

I keep coming back to a point I made in AI companies don’t trust each other: the labs themselves are paranoid about where their data flows. OpenAI clearly didn’t want its models on breachable infrastructure. Maybe take the hint they’re accidentally giving you. You can bring your own key to Dassi and keep your requests direct, or log in with a subscription you already pay for, and either way there’s no extra middleman to compromise. It’s a free Chrome extension.

The uncomfortable part

Convenience has a direction, and it points toward centralization. It’s genuinely easier to build a product where all the data flows through your servers, because then you can log it, debug it, cache it, and upsell against it. The breach risk is the bill that comes due for that convenience, and it usually lands on the user, not the vendor who chose the architecture.

Local isn’t automatically safe. But it changes what you’re even exposed to. When your agent runs where you already are, a breach three companies away in some AI supply chain stops being your emergency and starts being a headline you read over coffee. Which, honestly, is where I’d rather it stayed.