The Hugging Face artificial intelligence repository disclosed that attackers gained access to internal datasets and credentials after breaching its production infrastructure using an autonomous AI agent system.
Hugging Face is an open-source AI and machine learning platform that provides access to over 45,000 models from leading AI providers and is used by more than 50,000 organizations.
The company is still investigating whether partner or customer data was affected and said it would contact any affected parties directly. Hugging Face said it has found no evidence of tampering with public-facing models, datasets, or Spaces to date, and that its software supply chain has been “verified clean.”
The intrusion began in Hugging Face’s data-processing pipeline, with the attackers using a malicious dataset to exploit two code-execution vulnerabilities and run code on a processing worker. This allowed them to steal cloud and cluster credentials and move laterally across several internal clusters.
“The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness – used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services,” Hugging Face said in an incident disclosure published Thursday. “This matches the ‘agentic attacker’ scenario the industry has been forecasting.”
In response to the breach, Hugging Face has closed the vulnerable code execution paths (a template injection in a dataset configuration and a remote code dataset loader), evicted the attacker, rebuilt the compromised nodes, and revoked and rotated all affected credentials.
It also deployed improved malicious activity detection systems, reported the incident to law enforcement, and is now working with external forensic experts to assess the breach’s impact.
“We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried,” Hugging Face added.
“The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment.”
Hugging Face advised users to rotate access tokens and review recent account activity for signs of suspicious behavior and said it would continue sharing findings on defending against AI-driven attacks.
While this is the first security incident affecting the platform that has been linked to an AI agent, it’s not the first breach disclosed by Hugging Face in recent years.
The company also revoked some members’ authentication secrets and advised them to switch to fine-grained access tokens two years ago after hackers breached its Spaces platform.
Threat actors have also been abusing the platform in recent years to push malicious AI/ML models and infostealer malware, and to spread thousands of Android malware variants.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Over 20,000 Instagram accounts stolen in Meta AI support hack
Lidl discloses online shop breach after service provider hack
OpenAI temporarily relaxes GPT-5.6 Sol usage limits
Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time
Police suspects Dutch hackers were involved in Odido breach
Ernst & Young discloses data breach after support system hack
New Windows LegacyHive zero-day gives hackers admin privileges
CISA urges immediate action on actively exploited Fortinet flaws
AI is a data-breach time bomb: Read the new report
Pentest your web apps on-demand. Find what humans miss. Scope and launch a pentest in minutes.
AI broke vulnerability management. Get the guide CISOs use to shift budget to BAS.
Do you have what it takes to challenge DARKROOM? Signup for an exclusive DEFCON CTF!
Privacy by policy or privacy by architecture? See how age checks work when the face never leaves the device.
See how Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Read the case study.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
