Earlier this week Hugging Face detected and responded to an intrusion into part of its production infrastructure that was notable for being executed end to end by an autonomous AI agent system. The company used its own AI tooling to detect and dissect the incident.
What happened
According to Hugging Face, the intrusion began in the data-processing pipeline, a uniquely exposed area for AI platforms. A malicious dataset exploited two code-execution paths used during dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From that foothold the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into multiple internal clusters over a weekend.
The campaign was run by an autonomous agent framework that executed many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. Hugging Face says this behavior matches the industry’s anticipated “agentic attacker” scenario.
What was accessed and what was not
- The company identified unauthorized access to a limited set of internal datasets and to several credentials used by its services.
- Hugging Face found no evidence of tampering with public, user-facing models, datasets, or Spaces.
- The software supply chain (container images and published packages) was verified clean.
Hugging Face is completing its assessment of whether any partner or customer data was affected and will notify affected parties directly if required.
Actions taken
Hugging Face listed the following response measures:
- Fixed the root vulnerability by closing the dataset code-execution paths used for initial access.
- Eradicated the attacker’s foothold across affected clusters and rebuilt compromised nodes.
- Revoked and rotated affected credentials and tokens and initiated a broader precautionary rotation of secrets.
- Deployed additional guardrails and stricter admission controls on clusters.
- Improved detection and alerting so a high-severity signal pages a responder within minutes, any day of the week.
They are working with external cybersecurity forensic specialists to investigate and review security policies and have reported the incident to law enforcement.
Forensic analysis and the role of AI
The intrusion was first surfaced through AI-assisted detection: Hugging Face’s anomaly-detection pipeline uses LLM-based triage over security telemetry and the correlation of those signals flagged the compromise. The attacker action log contained more than 17,000 recorded events; to analyze this, Hugging Face ran LLM-driven analysis agents over the full log. This enabled reconstruction of the timeline, extraction of indicators of compromise, mapping of credentials touched, and separation of genuine impact from decoy activity — in hours rather than days.
Initial attempts to run the log analysis on frontier models behind commercial APIs failed because submitting large volumes of real attack commands, exploit payloads, and command-and-control artifacts triggered the providers’ safety guardrails. Those guardrails cannot reliably distinguish an incident responder from an attacker. As a result, the forensic analysis was run on GLM 5.2, an open-weight model, on Hugging Face’s own infrastructure. Running the analysis on-premises also ensured that no attacker data or referenced credentials left their environment.
The asymmetry problem and guidance
Hugging Face highlights a practical asymmetry: the attacker operated without usage-policy constraints (whether using a jailbroken hosted model or an unrestricted open-weight model is unknown), while defenders’ work can be blocked by hosted models’ guardrails. The company advises having a capable, vetted model ready to run on your own infrastructure before an incident occurs, both to avoid being locked out by guardrails and to prevent attacker data or credentials from leaving the environment. They note this is not an argument against safety measures on hosted models and that they have shared feedback with providers.
Implications
According to Hugging Face, autonomous, AI-driven offensive tooling is now a practical reality: it lowers the cost of running broad, patient, multi-stage campaigns and operates at machine speed. Defending online platforms therefore requires treating data and model surfaces as primary attack surfaces and applying AI to defense in order to keep pace. Hugging Face says it will continue to invest in these defenses and share lessons learned.
Advice to the community
As a precaution, Hugging Face recommends rotating access tokens and reviewing recent account activity. If users believe they are affected or wish to report a security concern, they should contact security@huggingface.co.
The company thanked Hugging Face teams for around-the-clock response and apologized for any disruption, reiterating that security is an ongoing effort.
