Hugging Face reveals an AI agent attack

Hugging Face has revealed an intrusion in which an autonomous system carried out thousands of actions to enter its infrastructure, steal credentials and move across several internal clusters. The company is still investigating whether any partner or customer data was affected.

The company says it has found no evidence of tampering with its models, datasets or public Spaces. It also detected no problems in its software supply chain, which includes published container images and packages.

The attack began in a dataset

The entry point was not a public model, but the process Hugging Face uses to prepare and analyze datasets. A malicious dataset exploited two paths capable of executing code:

• A loader that allows remote code execution when certain datasets are opened.
• A template injection in a dataset’s configuration.

The code ran on a machine dedicated to processing. From there, the attacker gained node-level access, collected credentials for cloud services and the cluster, and moved through several parts of the infrastructure over a weekend.

In practice, the incident shows why a data file can also be an entry point. If you process a dataset downloaded from the internet, you are not always handling passive information: in some environments, that file can trigger instructions or code.

A large-scale automated attack

According to Hugging Face, the campaign was carried out by a system of autonomous agents. This type of tool breaks an objective into many tasks and executes them automatically, instead of relying on a person to enter every command.

The system performed tens of thousands of actions from a network of temporary environments and used public services to maintain its control channel. The company recorded more than 17,000 events related to the attacker’s activity.

Hugging Face still does not know which language model powered those agents. It could have been a model hosted by a provider and manipulated to bypass its restrictions, or an open-weight model run without those limitations.

The important difference is that the attacker did not have to follow any usage policy. The defenders, by contrast, ran into limits.

AI helped detect and understand the incident

The intrusion was initially detected with help from a language-model-based analysis system. The tool reviews security signals and correlates them to separate real anomalies from the usual noise.

Hugging Face then used analysis agents to reconstruct the full activity, identify indicators of compromise, review which credentials had been accessed and distinguish real actions from possible decoys. The company says this work was completed in hours, whereas it would normally have taken several days.

At first, it tried to use advanced models through commercial APIs. That did not work: the systems blocked requests that included attack commands, exploit payloads and remote-control artifacts. Their filters could not distinguish between an incident response team and an attacker.

The analysis ultimately ran inside Hugging Face’s own infrastructure using GLM 5.2, an open-weight model. As a result, the attack data and the credentials mentioned in the logs did not have to leave the company’s environment.

What Hugging Face did

The company says it closed the code execution paths used for the initial access, removed the attacker’s presence and rebuilt the affected nodes. It also revoked and replaced the compromised credentials and tokens, while beginning a broader preventive rotation.

Additional measures include:

• Stricter controls for accepting workloads in clusters.
• New security barriers across the infrastructure.
• Alerts capable of notifying a responsible person within minutes.
• An investigation involving external digital forensics specialists.
• Notification of the incident to authorities.

Hugging Face recommends that users rotate their access tokens and review recent activity on their accounts. The company will contact affected parties directly if it confirms that their data was involved.

For you, the lesson is concrete: old tokens, datasets from questionable sources and systems that execute code while processing data need special review. Organizations should also have a model ready to run on their own infrastructure so they can investigate incidents without sending sensitive information to external services.

The case confirms that automated AI attacks are already part of the operational risk facing digital platforms. From now on, protecting AI infrastructure will require more than monitoring models and accounts: you also need to treat data, processing pipelines and automated agents as high-priority attack surfaces.