Hugging Face Reports Security Breach by Autonomous AI Agent
Hugging Face, a prominent platform for sharing open-source machine learning models and datasets, has disclosed a security breach attributed to an autonomous AI agent. In a blog post dated July 16, the company reported that it detected unauthorized access to internal datasets and several service credentials earlier that week. The breach occurred through a malicious dataset that exploited two vulnerabilities in the dataset processing pipeline, specifically a remote-code dataset loader and a template-injection in a dataset configuration. This allowed the attacker to execute code on a processing worker, escalating to node-level access and harvesting cloud and cluster credentials, ultimately moving laterally into several internal clusters over a weekend.
The company is currently investigating the incident but has not found evidence that the attacker accessed partner or customer data or tampered with public models, datasets, or Spaces. Hugging Face confirmed that its software supply chain, including container images and published packages, was verified as clean. In response to the breach, the company has blocked the exploited code-execution paths, removed the attacker from affected clusters, and rebuilt compromised nodes. They have also begun revoking and rotating compromised credentials and tokens, while implementing additional security measures and stricter admission controls on their clusters. Furthermore, Hugging Face has improved its detection and alerting systems to ensure high-severity signals are forwarded to responders within minutes.
As a precautionary measure, the company has advised users to rotate their access tokens and review recent account activity. Hugging Face utilized its own AI capabilities to detect and analyze the attack. Their anomaly-detection pipeline employs large language model (LLM)-based triage over security telemetry to differentiate genuine signals from background noise, which helped flag the compromise. The attacker’s action log, containing over 17,000 recorded events, was analyzed by LLM-driven agents that constructed a timeline of the attack, identified affected credentials, and mapped the decoy activities engaged in by the attacker.
The investigation concluded that the breach was executed by an autonomous agent framework utilizing an unknown LLM, which performed thousands of actions across numerous short-lived sandboxes and employed a self-migrating command-and-control system staged on public services. While Hugging Face successfully leveraged LLMs for analysis and response, they noted that commercial API models were not helpful, as their guardrails blocked some requests containing real attack commands and exploit payloads. Instead, they conducted forensic analysis using GLM 5.2, an open-weight model on their own infrastructure. The company advises others to prepare similar self-hosted setups for investigating future incidents while maintaining the confidentiality of attacker data and credentials.
