Hugging Face: Cyberattack by an Autonomous AI Agent. Infrastructure Breached
Hugging Face has suffered a sophisticated cyberattack that compromised internal datasets and service credentials. The incident, revealed last Thursday, has been attributed to an "autonomous AI agent" that orchestrated thousands of actions through temporary sandboxes, a dynamic that the company itself has termed the "agentic attacker scenario" predicted by the industry.
The intrusion began in Hugging Face's data processing pipeline. Attackers uploaded a malicious dataset, exploiting two code execution vulnerabilities to operate on a processing worker. This allowed the perpetrators to steal cloud and cluster-related credentials, extending their presence across multiple internal clusters. The specific vulnerabilities included a template injection in a dataset configuration and a dataset loader with remote code execution capability.
Hugging Face is still verifying whether partner or customer data was involved in the breach, committing to contact affected parties directly if involvement is confirmed. To date, the company has not found alterations to public models, datasets, or Spaces hosted on the platform. The internal software supply chain has been checked and is reported to be "clean" from contamination.
Countermeasures and the Role of AI in Defense
In response to the attack, Hugging Face immediately closed the vulnerable code execution paths. They removed the attacker from the compromised systems, rebuilt the affected nodes, and revoked and rotated all compromised credentials. More effective malicious activity detection systems have also been implemented. The incident has been reported to law enforcement, and the company is cooperating with external forensic experts to assess the full scope of the breach.
Hugging Face has reconstructed the dynamics: the campaign was orchestrated by an autonomous agent framework—whose underlying LLM is unknown but appears to be based on a harness for agentic security research. This system executed thousands of individual actions through a swarm of ephemeral sandboxes, with a command and control system capable of autonomously migrating, hosted on public services.
It is unclear which AI model powered the attacker’s agents—whether it was a “jailbroken” hosted model or an unrestricted open-weight model. Hugging Face noted that the attacker was not bound by any usage policy, while internal forensic work was hampered by the hosted model "guardrails" that the company initially attempted to employ for log analysis. This limitation hindered a thorough investigation via commercial services.
Initially, the company tried to use a frontier commercial AI model to analyze the attack logs, but the "guardrails" imposed by the provider blocked the analysis efforts. To overcome this issue, Hugging Face employed its own local large language model, gaining the additional benefit of not having to upload sensitive logs to third-party servers.
This experience led Hugging Face to advise defenders to have capable, vetted AI models ready to run on their infrastructure prior to an incident. This helps avoid blocks due to external "guardrails" and keeps sensitive attack data within their controlled environment. Hugging Face will continue to share its findings on defense against AI-driven attacks.
User Advice and Previous Incidents
Hugging Face has urged users to rotate their access tokens and closely monitor recent account activity for any suspicious behavior. This incident, while the first linked to an AI agent, is not the platform's first security breach. Two years ago, the company had already revoked some authentication secrets and advised users to switch to granular access tokens following a previous breach of the Spaces platform.
In recent years, malicious actors have abused the platform to distribute malicious AI/ML models, infostealer malware, and thousands of variants of Android malware. Therefore, the security of AI platforms is an increasingly critical and hot issue.