Hugging Face says autonomous AI agent breached internal systems

Hugging Face disclosed a breach of parts of its production infrastructure that it says was carried out by an autonomous AI agent system, with attackers using a malicious dataset to reach internal systems and steal credentials. The company said no public models, datasets or Spaces were modified, and that its software supply chain was not affected, but it has not yet determined whether partner or customer data was compromised.

The incident is notable because Hugging Face is both a core distribution point for open AI models and a major host for datasets and AI apps. If the company’s account is accurate, the breach is a concrete example of the agentic attack pattern security teams have been modeling: automated, multi-step intrusion attempts that can run at high volume across cloud and internal infrastructure.

Dataset processing was the entry point

According to Hugging Face, the attack began in its dataset processing pipeline. The company said a malicious dataset exploited two execution paths: a remote-code dataset loader and a template injection issue in a dataset configuration.

From that foothold, the attacker escalated to node-level access, collected cloud and cluster credentials, and moved across several internal clusters during a weekend, Hugging Face said. The company described the operation as being coordinated by an autonomous agent framework built on an agentic security research harness.

Hugging Face said it does not know which language model powered the attacker’s system. The company said the campaign involved thousands of actions, a group of short-lived sandboxes and command-and-control infrastructure that moved across public services.

Hugging Face used AI for forensics

The company said it detected the intrusion through an AI-based anomaly detection pipeline that applies LLM triage to security telemetry. It then used LLM-driven analysis agents to review more than 17,000 recorded attacker actions.

Those internal tools reconstructed the incident timeline, pulled indicators of compromise, mapped affected credentials and separated actual damage from decoy or misleading activity, according to Hugging Face. The company said that work took hours rather than the days a manual investigation would normally require. It did not provide a full independent forensic report in the disclosure.

A second point in the disclosure will interest security operators buying AI tools from hosted model providers. Hugging Face said its first attempts to analyze the logs with frontier models behind commercial APIs were blocked by provider safety systems. The requests included real attack commands, exploit payloads and command-and-control artifacts, which the providers’ filters treated as unsafe.

Hugging Face said it instead ran the open-weight GLM 5.2 model on its own infrastructure. The company argued that this kept attacker data and referenced credentials inside its environment and avoided the hosted-model guardrails that had blocked its incident response work.

Containment and remaining questions

Hugging Face said it closed the exploited code paths, cut off the attacker’s access, rebuilt compromised nodes and rotated affected credentials. It also said it tightened access controls, improved detection systems, brought in external cybersecurity forensics experts and reported the incident to law enforcement.

The company is advising users to rotate access tokens and review recent account activity as a precaution. That recommendation is broader than the specific impact it has confirmed so far, since the company says the question of partner or customer data exposure remains under investigation.

Hugging Face also used the disclosure to argue that defenders should have capable models available on their own infrastructure before an incident. That is a practical security point, but also a commercial and strategic one for one of the largest platforms in open AI. The harder industry problem is that safety filters built to prevent misuse can also slow legitimate incident response when defenders need to process live exploit material.

This story draws on original reporting from The Decoder.