Hugging Face needed an open-weights model to decode attacker payloads after commercial models refused.

GIGAZINE's timeline reconstruction reports that GLM-5.2, both full and the quantized NVFP4 build, decoded obfuscated attacker payloads after commercial models declined the task, recovering the chunk+XOR+compress scheme and the per-campaign key. That recovery uncovered roughly 4x the initial count of hidden credentials and was central to correlating ~17,600 inconsistent attack traces into a coherent timeline. Refusal behavior in hosted models blocked legitimate incident response, and an open-weights model was the workaround. Keep one in your DFIR toolkit.