Hugging Face says autonomous AI agents breached production systems

Hugging Face disclosed that autonomous AI agents broke into its production infrastructure, compromising what it described as a “limited set” of internal datasets and “several” service credentials. The company also said hosted frontier models were not usable for parts of its forensic work because safety guardrails blocked analysis of real attack artifacts, pushing its team to run an open-weight Chinese model on its own systems.

The AI development platform said in a Thursday security disclosure that it is still investigating whether partner or customer data was exposed. Hugging Face said it has found “no evidence” that public user-facing models, datasets or Spaces were altered, and said its container images and published packages were verified as clean.

The company did not identify the model or models used by the attackers. Hugging Face said the intrusion was “driven, end to end, by an autonomous AI agent system” and involved many thousands of actions across short-lived sandboxes, with command-and-control infrastructure staged on public services and able to migrate itself.

For AI infrastructure companies, the incident is a useful marker: agentic attacks are no longer only a conference scenario or red-team demo. Hugging Face is one of the main hubs for model hosting, datasets and ML tooling, so a production intrusion there will get read closely by security teams at AI labs, cloud platforms and software vendors building around open models.

Guardrails complicated the response

Hugging Face said its security team first tried unnamed advanced commercial models for log analysis. The problem, according to the company, was that the forensic task required feeding the models real attack commands, exploit payloads and command-and-control artifacts, the same categories of content hosted LLM guardrails are designed to reject.

“The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried,” the Hugging Face security team wrote. The company said it is not arguing against safety measures on hosted models and has shared what happened with the model providers.

The team then used GLM 5.2, an open-weight model from Chinese AI company Z.ai, running inside Hugging Face’s own infrastructure. Hugging Face said that approach had a second benefit: attacker data and referenced credentials did not leave its environment.

The company’s recommendation to defenders was direct: have a capable model vetted and ready to run internally before an incident, both to avoid guardrail lockout and to keep sensitive incident data inside the organization. That is a practical point for security operators weighing hosted AI tooling against self-hosted models, particularly in incident response where logs can contain secrets, payloads and live infrastructure details.

Agent-led intrusions are becoming documented cases

The disclosure follows other recent reports of AI systems carrying more of the operational load in attacks. The Register recently reported comments from TrendAI vice president of AI and security threat research Tom Kellermann about an attack in which a jailbroken Google Gemini system did about 90 percent of the work, including creating a new command-and-control server in six minutes.

Earlier in July, Sysdig threat researchers documented what they described as the first known agentic ransomware infection in which an LLM, rather than a human operator, drove the extortion flow from initial access through compromise of a production database server and data destruction.

Chris Boehm, field CTO at Zero Networks, told The Register that the Hugging Face incident resembled a burglar trying a thousand door handles at once. He said the more unsettling part was that commercial AI systems could not help defenders analyze the attack because the requests looked like real offensive commands.

The unresolved questions remain material. Hugging Face has not said which attacker model was used, how long the intrusion lasted, which credentials were exposed or whether any customer or partner data was accessed. Until those details are available, the main confirmed signal is narrower: autonomous agents were able to operate inside a major AI platform’s production environment, and the first generation of hosted LLM safety controls created friction for the defenders trying to investigate it.

This story draws on original reporting from The Register.