The attacker (OpenAI) was using the model without guardrails.

The defender (huggingface) did not have access to the top models so had to use weaker ones to detect the threat.