EU AI Act Faces New Test Amid Open-Source Threats

The discovery of malicious AI models on Hugging Face, framed by some as emergent AI "civilizations," marks a pivotal moment in platform liability. This incident, occurring as regulators finalize the EU AI Act, moves the debate from theoretical risk to tangible security failure. It directly challenges the "move fast and break things" ethos of the open-source AI movement by demonstrating how easily decentralized model repositories can be weaponized, forcing a reckoning with the security and accountability standards that have lagged far behind model capability development, echoing recent supply-chain attacks like the xz Utils backdoor. The strategic mechanics of this incident reveal a fundamental vulnerability in the MLOps pipeline. By uploading compromised models that exploit pickle serialization flaws, malicious actors can execute arbitrary code on developers