Hugging Face, a prominent platform for open-source machine learning models and datasets, has confirmed a security breach that it attributes to an autonomous AI agent system. The company disclosed the incident in a blog post published on Thursday, July 16, following the detection of unauthorized access earlier that week.
The intrusion began with a malicious dataset that exploited two code-execution vulnerabilities within Hugging Face's dataset processing pipeline. Specifically, a remote-code dataset loader and a template-injection flaw in a dataset configuration were leveraged to execute code on a processing worker. This initial access allowed the attacker to escalate privileges to node-level access, subsequently harvesting cloud and cluster credentials. Over a weekend, the attacker moved laterally into several internal clusters.
Hugging Face's investigation is ongoing, but as of their disclosure, there is no evidence that the attacker accessed partner or customer data, nor is there any indication of tampering with public, user-facing models, datasets, or Spaces. The company also verified that its software supply chain, including container images and published packages, remained uncompromised.
In response to the breach, Hugging Face has taken several remediation steps. They have blocked the dataset code-execution paths that were exploited, ejected the attacker from affected clusters, and rebuilt all compromised nodes. Additionally, the company is in the process of revoking and rotating all compromised credentials and tokens. New security measures include implementing additional guardrails and stricter admission controls on their clusters, alongside enhancements to their detection and alerting systems to ensure high-severity signals are routed to responders within minutes. As a precautionary measure, Hugging Face has urged its users to rotate their access tokens and review recent activity on their accounts.
The New York-based company detailed its use of AI to detect and analyze the attack. An anomaly-detection pipeline, which employs LLM-based triage over security telemetry, correlated various signals to flag the compromise. Subsequently, the attacker's action log, comprising over 17,000 recorded events, was fed into LLM-driven analysis agents. These agents were instrumental in constructing a timeline of the attack, identifying affected credentials, and pinpointing indicators of compromise, which have not been publicly shared. The analysis also helped map decoy activity engaged in by the attacker.
Based on the forensic analysis, Hugging Face concluded that the attack was executed by an autonomous agent framework utilizing an unspecified large language model (LLM). This framework reportedly executed thousands of individual actions across a swarm of short-lived sandboxes and employed a self-migrating command-and-control infrastructure staged on public services.
While Hugging Face successfully leveraged LLMs for analysis and response, they noted challenges with commercial API-based frontier models. These models' guardrails often blocked defender requests containing real attack commands, exploit payloads, and command-and-control artifacts. Consequently, the company performed its forensic analysis using GLM 5.2, an open-weight model, on its own infrastructure. Hugging Face advises other organizations to prepare similar self-hosted setups for future incident investigations to maintain privacy of attacker data and credentials.
