Hugging Face security breach driven by autonomous AI agent exposes cybersecurity vulnerabilities

Hugging Face confirms breach affected internal datasets and credentials, urges users to take action

Hugging Face, a platform that hosts AI models and datasets, said its internal datasets and service credentials were compromised in a hack last week. The company disclosed the breach on Friday, but said it was still investigating whether any customer or partner data was stolen during the incident. In a blog post, the company said a dataset uploaded to its platform abused a security vulnerability to run malicious code on its servers, allowing the attackers to escalate their permissions and gain broader access to Hugging Face's internal systems. The company said it has revoked and rotated the stolen credentials that were accessed. It urged users to do the same with any keys stored on the platform, and review any suspicious activity on their accounts. Hugging Face said it has fixed the vulnerability that was abused during the cyberattack. While it's common for hackers to try to break into a company's network using stolen employee credentials, keys, or a weak point in their security perimeter, this incident underscores the challenges that companies like Hugging Face face when hackers try to abuse platforms and tools to access and steal sensitive data from within. Hugging Face blamed the breach on an external AI agent, which executed "many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services." The company did not immediately provide evidence for this claim when asked by TechCrunch. Hugging Face said its own anomaly detection spotted the attack, and used an AI model to analyze server logs that kept record of the cyberattack. The company said it initially used a frontier AI model from a commercial provider, though it didn't name a company, but found that the analysis effort was blocked by the provider's guardrails. Instead, the company used its own local large language model, which it said provided the added benefit of not having to upload sensitive attack logs to an AI company's servers. Security researchers have previously complained that some frontier models, like Anthropic's Mythos and Fable, are heavily constrained, and prevent defenders from inquiring about almost anything relating to cybersecurity, including for defense and investigations. Frontier AI model makers, including Anthropic, have butted heads with the Trump administration over fears and concerns about the ability to use these models for offensive cyberattacks. Anthropic was even forced to withdraw Fable from public use after the U.S. government enforced export controls on the model. Hugging Face said it has reported the incident to law enforcement and roped in cybersecurity forensic specialists to investigate the breach and review its security. It's not clear if Hugging Face had performed a security audit of its systems before it launched. A Hugging Face spokesperson did not respond to a request for comment on Monday.

HuggingFace breach that's blamed on AI agent is defended by AI, too - what users should do next

Follow ZDNET: Add us as a preferred source on Google. ZDNET's key takeaways * Hugging Face discloses a cyberattack that compromised internal infrastructure and credentials. * An autonomous AI agent has been blamed for the breach. * An AI, in turn, detected the intrusion -- but is AI-enabled defense enough to stop future attacks? Hugging Face has disclosed a security incident, believed to be the work of an unknown agentic AI, that exposed its production platform and credentials. It's not known if partner or customer data was affected. What is Hugging Face? Hugging Face is an open source repository and community platform that describes itself as "where the machine learning community collaborates on models, datasets, and applications." Also: 5 security tactics your business can't get wrong in the age of AI - and why they're critical The platform, a diverse resource for those interested in AI and large language models (LLMs), offers datasets, applications, models, trending AI creations, as well as collaboration opportunities. Dataset turned disaster In a security advisory published July 16, Hugging Face said that it detected unauthorized access to a limited set of internal datasets and to several credentials used by the platform's services. The attack began with the Hugging Face data processing pipeline. A dataset deployed by the attacker included the ability to exploit two code-execution paths -- a remote code dataset loader and a template injection in a dataset configuration -- to execute malicious code on a processing worker. This enabled the attacker to escalate its privileges to node-level access, infiltrate the production pipeline, move across the network, and steal cloud and cluster credentials. Also: Why this fully agentic ransomware attack is giving researchers nightmares One could imagine this being the work of a traditional cybercriminal. However, Hugging Face says it was actually an unknown agentic AI that executed "many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services." Over 17,000 events linked to this automated attack were recorded. "This matches the 'agentic attacker' scenario the industry has been forecasting," Hugging Face added. The organization hasn't found any evidence of tampering with public and user-facing models, Spaces, or its software supply chain -- at least, at this stage. HuggingFace's AI defense and response Data breaches, information leaks, and security incidents are, unfortunately, now very common -- but it is the combination of AI on AI that makes the Hugging Face incident stand out. While an agentic AI has been blamed for launching the attack, it was also an AI that "largely detected" the incident, according to Hugging Face. Hugging Face's own LLM tools flagged the security event and also analyzed the attack log, leading to a timeline reconstruction, indicators of compromise, and a map of credentials exposed and stolen, a task that took mere hours when "[it] would usually take days," according to the team. Also: These 4 critical AI vulnerabilities are being exploited faster than defenders can respond "Autonomous, AI-driven offensive tooling is no longer theoretical," the organization noted. "It lowers the cost of running a broad, patient, multi-stage campaign, and it operates at machine speed. Defending an online platform now means treating the data and model surface as a first-class attack surface, and using AI on defense to keep pace." We will likely see the evolution of both AI-based attacks and defenses in the coming months and years. In the meantime, Hugging Face has fixed the root vulnerability that allowed for initial access; wiped out all traces of the attacker in impacted clusters, rebuilt compromised nodes, revoked and rotated secrets, and deployed additional guardrails and stricter admission controls across clusters. What Hugging Face users should do next Hugging Face is assessing whether any partner or customer data was affected by the breach and will contact affected parties. Until Hugging Face learns exactly which datasets, partners, and users are affected -- if any -- it recommends precautionary measures to keep user accounts and information safe. Also: AI agents are fast, loose, and out of control, MIT study finds Users should rotate their access tokens and keep a diligent watch on their accounts for any signs of unusual, unknown, or suspicious activity. If Hugging Face users believe they have been impacted by this breach, they should reach out to the organization directly at [email protected].

AI Platform Hugging Face Fends Off Hack From... AI

Hugging Face, an online platform that hosts AI models, has suffered a breach that apparently came from an autonomous AI program. The New York-based company detected the intrusion last week after noticing "a swarm of tens of thousands of automated actions" in Hugging Face's internal systems, it wrote in a report. The breach exploited how users can upload data to Hugging Face, which hosts over 2 million public AI models, including those from top providers such as OpenAI. Specifically, the attack uploaded a malicious dataset that exploited "two code-execution paths" in Hugging Face's data processing pipeline to run rogue code. "From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend," the company said. As a result, the attack was able to breach "a limited set of internal datasets and...several credentials used by our services." In response, Hugging Face moved to plug the root vulnerability and boot out the attacker, including revoking login credentials and tokens. Although Hugging Face is still investigating the incident, the company says: "We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean." However, Hugging Face is still determining whether any customer or partner data was affected. At the end of 2025, the platform grew to 13 million users. In the meantime, the breach stands out because Hugging Face suspects "an autonomous AI agent system" orchestrated the entire intrusion. The company notes the attacker executed "many thousands of individual actions across a swarm of short-lived sandboxes." It's unclear how the malicious AI agent was built. But Hugging Face suspects the hacker used an AI program focused on cybersecurity research, which would explain the malicious program's ability to quickly identify a software flaw and exploit it. "Autonomous, AI-driven offensive tooling is no longer theoretical. It lowers the cost of running a broad, patient, multi-stage campaign, and it operates at machine speed," the company added. The breach highlights the growing menace of AI-assisted hacks. In November, Anthropic uncovered evidence that Chinese state-sponsored hackers used its AI coding tool to automate the attempted hacking of 30 global targets. Matching the Adversary's Speed In Hugging Face's case, the company fought fire with fire by initially detecting the intrusion through its own AI tool. "Our anomaly-detection pipeline uses LLM [large language model]-based triage over security telemetry to separate real signals from the daily noise, and it was the correlation of those signals that flagged the compromise," the company said. Hugging Face then used a Chinese-developed open-weight AI model, GLM 5.2, to analyze the attack, which spanned over 17,000 recorded events. "Thanks to this approach, we were able to do in hours what would usually take days, and match the adversary's speed," it added. To fend off future hacks and bolster security, the IT industry has started to use cutting-edge AI models, including Anthropic's Mythos, to help identify and patch software bugs at a potentially faster rate. Hugging Face said using AI will help it keep pace against cybersecurity threats. Still, the company noted it first tried using a leading-edge "frontier" AI model from the top providers to analyze the attack. But ironically, the providers rejected the request, since "these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker," it said. "The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment," Hugging Face added.

Frontier LLMs couldn't help Hugging Face fight off evil agents

Apparently, being a leading destination for AI development doesn't mean AI will bail you out. AI agents broke into Hugging Face's production infrastructure, but commercial LLM guardrails blocked the forensic investigation, forcing it to turn to a Chinese open-weight model instead. The intrusion, "driven, end to end, by an autonomous AI agent system," compromised a "limited set" of Hugging Face's internal datasets and "several" credentials used by its services, according to a Thursday security incident disclosure. While the ML platform says that it's still investigating whether any partner or customer data was exposed in the breach, there's "no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean." It also doesn't know which model the attackers used to power a swarm of AI agents, which, we're told, executed many thousands of individual actions across short-lived sandboxes, using self-migrating command-and-control staged on public services. "This matches the 'agentic attacker' scenario the industry has been forecasting," according to the Hugging Face blog. Additionally, after unsuccessfully using unnamed frontier models to start the forensic analysis, the Hugging Face security team ultimately ran the log analysis on GLM 5.2, an open-weight model developed by Chinese AI firm Z.ai, on the platform's own infrastructure. The advanced commercial models didn't work because their analysis required submitting real attack commands, exploit payloads, and command-and-control artifacts - all of the things that the LLMs' guardrails have been trained to block so that the AI systems can't be used in real-life attacks. "The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried," the security team wrote, noting that it's not arguing against safety measures on hosted models and has shared this information with the LLM providers. Using GLM 5.2 had another benefit, Hugging Face noted: "No attacker data, and none of the credentials it referenced, left our environment." This also serves as an important reminder to defenders, according to the AI platform. "Have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment." The Hugging Face intrusion is yet another indication that attacks carried out by autonomous AI agents are no longer a future threat, but rather the current state of AI-based intrusions. Last week, The Register spoke with TrendAI VP of AI and security threat research Tom Kellermann about another recent attack, during which a jailbroken Google Gemini did 90 percent of the work - including spinning up a new C2 server in just six minutes. The human did just 10 percent. Additionally, earlier in July, Sysdig threat hunters documented what they say is the first-ever documented agentic ransomware infection with an LLM - not a human - driving the entire extortion operation, from gaining initial access to compromising a production database server and destroying data. "Think of a burglar that never gets tired, never needs sleep, and instead of jiggling one door handle at a time, is trying a thousand of them simultaneously," Zero Networks field CTO Chris Boehm said in an email to The Register about the Hugging Face intrusion. "That's basically what happened here. Not one guy typing commands into a terminal, a swarm of little automated processes hammering away nonstop, hopping between hiding spots to make it harder to trace," Boehm said. He added, the "part that actually unsettles" him most is that the platform's security team couldn't get commercial AI tools to help analyze the attack, "because those tools were built to refuse anything that looked like a real attack command. It didn't matter that it was the good guys asking." Boehm said the takeaway for security teams is twofold: "These agents can now move faster and more relentlessly than any human ever could, and the safety tools we're building aren't always ready to help us respond at that speed."®

Hugging Face discloses breach linked to autonomous AI agent

The Hugging Face artificial intelligence repository disclosed that attackers gained access to internal datasets and credentials after breaching its production infrastructure using an autonomous AI agent system. Hugging Face is an open-source AI and machine learning platform that provides access to over 45,000 models from leading AI providers and is used by more than 50,000 organizations. The company is still investigating whether partner or customer data was affected and said it would contact any affected parties directly. Hugging Face said it has found no evidence of tampering with public-facing models, datasets, or Spaces to date, and that its software supply chain has been "verified clean." The intrusion began in Hugging Face's data-processing pipeline, with the attackers using a malicious dataset to exploit two code-execution vulnerabilities and run code on a processing worker. This allowed them to steal cloud and cluster credentials and move laterally across several internal clusters. "The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services," Hugging Face said in an incident disclosure published Thursday. "This matches the 'agentic attacker' scenario the industry has been forecasting." In response to the breach, Hugging Face has closed the vulnerable code execution paths (a template injection in a dataset configuration and a remote code dataset loader), evicted the attacker, rebuilt the compromised nodes, and revoked and rotated all affected credentials. It also deployed improved malicious activity detection systems, reported the incident to law enforcement, and is now working with external forensic experts to assess the breach's impact. "We do not know which model powered the attacker's agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried," Hugging Face added. "The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment." Hugging Face advised users to rotate access tokens and review recent account activity for signs of suspicious behavior and said it would continue sharing findings on defending against AI-driven attacks. While this is the first security incident affecting the platform that has been linked to an AI agent, it's not the first breach disclosed by Hugging Face in recent years. The company also revoked some members' authentication secrets and advised them to switch to fine-grained access tokens two years ago after hackers breached its Spaces platform. Threat actors have also been abusing the platform in recent years to push malicious AI/ML models and infostealer malware, and to spread thousands of Android malware variants.

World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent

In an ironic twist, open-source artificial intelligence (AI) platform Hugging Face revealed that it was the victim of a hack perpetrated by an autonomous AI agent system. The company said it detected and responded to the incident targeting its production infrastructure earlier last week. "We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services," the company said in a statement. While an investigation into the intrusion remains ongoing, Hugging Face said it has found no evidence that the AI agent tampered with public, user-facing models, datasets, or Spaces, and its own software supply chain. The starting point of the attack was the data processing pipeline itself, with a malicious dataset abusing two code execution paths, viz., in its remote code dataset loader and a template injection in a dataset configuration, to run code on a processing worker. With that access, the threat actor is said to have escalated to node-level access, collected cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. The exact large language model (LLM) used to pull off the attack is unclear, but the campaign was executed by an autonomous agent framework performing "many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services." Hugging Face said it has since addressed the root cause of the issue, precisely the code execution pathways used for initial access. It also carried out the following remediation steps - * Removed the attacker's foothold across the affected clusters and rebuilt the compromised nodes * Revoked and rotated the affected credentials and tokens, and a broader rotation of secrets was undertaken as a precautionary measure. * Deployed additional guardrails and stricter admission controls on its clusters * Improved detection and alerting to ensure responders are notified within minutes, 24x7 As a further safeguard, Hugging Face is urging customers to rotate any access tokens and review recent activity on their accounts. The company also said it turned to Z.ai's GLM 5.2, a Chinese open-weight model, to conduct the forensic analysis after Western frontier models refused requests containing real attack commands, exploit payloads, and command-and-control (C2) artifacts because their safety guardrails were triggered and their inability to differentiate between an attacker and a legitimate incident response effort. "This experience points to a gap worth planning for," the New York-headquartered company said. "We do not know which model powered the attacker's agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried." "The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment."

An AI agent hacked Hugging Face. Another AI caught it.

An autonomous AI agent broke into Hugging Face's production systems. The company caught and dissected the attack with AI of its own, in what looks like the first confirmed AI agent breach of a major AI platform. The machines are now hacking each other. Hugging Face, the world's largest hub for open AI models, says an autonomous AI agent broke into its production infrastructure. Its own AI defences spotted the intrusion and picked it apart. The company disclosed the incident in a statement on 16 July. It called the attack different from anything it had handled before. The reason: an autonomous agent system ran it, end to end. "We detected and dissected it largely with AI of our own," Hugging Face said. How the agent got in The break-in started in the data pipeline, the part of an AI platform that ingests datasets. A malicious dataset abused two code-execution paths in Hugging Face's processing system. That let it run code on one of the company's workers. From there, the attacker climbed. It won deeper access to the machine, then harvested cloud and cluster credentials. Over a single weekend, it moved sideways into several internal clusters. The scale is the striking part. The campaign ran across a swarm of short-lived sandboxes. It fired off many thousands of actions and left more than 17,000 recorded events. Its command-and-control servers kept moving on their own, hidden on public services. Hugging Face said the framework appeared to be built on an agentic security-research harness. It does not know which model powered the attack. Nor does it know whether that model was a jailbroken commercial one or an unrestricted open-weight one. The attack matches what the industry has been forecasting. Hugging Face said it fit the "agentic attacker" scenario security teams have warned about for months. The Hacker News, which covers the sector, called it an ironic hit on the world's largest AI model hub. What the attacker took The damage was real but contained, on Hugging Face's account. The agent reached a limited set of internal datasets and several credentials used by its services. Crucially, the company found no sign the attacker touched public models, datasets, or Spaces. Its software supply chain, meaning its container images and published packages, came back clean. Hugging Face is still checking whether any partner or customer data was caught up in the breach. As a precaution, it told users to rotate their access tokens and review recent account activity. It has since closed the vulnerability, rebuilt the compromised machines, rotated its secrets, and reported the incident to law enforcement. AI caught the AI The defence is where the story turns. Hugging Face runs an anomaly-detection pipeline that uses an LLM to triage security data. It sorts real threats from the daily noise. That system flagged the compromise. To make sense of tens of thousands of automated actions, the team then set its own analysis agents loose on the full attack log. The AI rebuilt the timeline, pulled out indicators of compromise, and mapped every credential the attacker had touched. It also split genuine damage from decoy activity meant to waste responders' time. The payoff was speed. Hugging Face said it did in hours what would normally take days, matching the attacker's pace. In a fight at machine speed, that gap matters. It is the same bet Microsoft and others are now making on the defensive side. The guardrail twist Then came a problem Hugging Face did not see coming. When its team tried to analyse the attack, it first reached for frontier models behind commercial APIs. The models refused. Forensic work means feeding a model real attack commands, exploit code, and other hostile artefacts. The safety guardrails on hosted models could not tell an incident responder from an attacker. So they said no. Hugging Face switched to GLM 5.2, an open-weight model from the Chinese lab Z.ai, and ran it on its own hardware, The Stack reported. It worked. It also kept the attacker's data and the exposed credentials inside the company's walls. Hugging Face drew a pointed lesson from that. "The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried," it said. Its advice to other defenders: keep a capable model you can run on your own infrastructure vetted and ready before an incident hits. The company stressed it was not arguing against safety measures on hosted models, and said it had passed the feedback to the providers involved. It did not name which ones it had tried. A charged moment for open models The choice of a Chinese model lands at a loaded time. Hugging Face published its report the same day Moonshot unveiled Kimi K3, billed as the largest open-weight AI model yet. Open models from Chinese labs, among them Z.ai's GLM line, have been closing the gap on their US rivals on both cost and capability. A warning shot The wider point outlasts this single breach. Autonomous, AI-driven attack tools are no longer a thought experiment. They cut the cost of running a patient, multi-stage campaign, and they run at machine speed. For anyone running an online platform, Hugging Face argued, the data and model layer is now a front-line target. Its own answer was to fight AI with AI. On this evidence, defenders may not have much choice.

Hugging Face: We Used AI to Catch the First Confirmed AI Agent Breach of a Major AI Platform

Hugging Face recently disclosed details of what appears to be the first publicly known case of AI-on-AI cybercrime against a major AI platform. The popular platform for hosting and sharing AI models and datasets said in a blog post last week that it had detected and responded to an intrusion into part of its production infrastructure. But the attack was unlike anything the company had encountered before. Hugging Face said the campaign was "driven, end to end, by an autonomous AI agent system." In a reverse-card move, the company used AI of its own to detect and analyze the attack. The Next Web described the incident as what appears to be the first confirmed AI-agent breach of a major AI platform. According to the company's disclosure, the attack began with a malicious dataset that exploited two vulnerabilities in its data-processing pipeline. Those vulnerabilities allowed the attacker to run code on a server known as a processing worker. The attacker was then able to get node-level access and collect cloud and cluster credentials to move around several internal clusters over the course of a weekend. "The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services," Hugging Face wrote in the blog post. Hugging Face said the incident follows the agentic attacker scenarios that the industry has been ringing alarms about. Still, it is a little surprising that more AI platforms have not publicly reported attacks like this. This breach offers the best glimpse of what an agentic attack is actually capable of when targeting an AI platform. The incident also comes amid growing concern over the advanced cybersecurity capabilities of the latest AI models. The U.S. government briefly ordered Anthropic to block foreign nationals inside and outside the country from accessing its most advanced models, citing national security concerns. Anthropic responded by suspending access worldwide until the restrictions were lifted on June 30. Fable 5 is now available with additional safeguards, while access to the less restricted Mythos 5 remains limited. Ironically, the kinds of safeguards meant to prevent AI-assisted cyberattacks made it more difficult for Hugging Face to investigate this one. Hugging Face said it was able to detect the attack with the help of AI. But when it tried to use frontier models accessed through commercial APIs to analyze the attack, its requests were blocked. The forensic work required feeding the models large volumes of real attack commands. According to Hugging Face, the commercial models' safeguards could not distinguish between an attacker and a security team investigating an actual breach. Hugging Face wrote that, "the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried." The company instead turned to GLM 5.2, a Chinese open-weight model, running on its own infrastructure. Hugging Face used AI to examine more than 17,000 recorded events, reconstruct the attack's timeline, identify which credentials had been exposed and distinguish genuine damage from decoy activity. The company said AI allowed its team to complete in an hour what would normally have taken days. Hugging Face said it is still determining whether any customer or partner data was affected. So far, it has found no evidence that the attacker tampered with public-facing models, datasets, or Spaces. Additionally, the company said it has fixed the vulnerabilities that were used to gain initial access, removed the attacker's access to the affected clusters, rebuilt compromised nodes, and revoked and rotated exposed credentials and tokens. It has also brought in outside cybersecurity specialists and reported the incident to law enforcement. Hugging Face is advising users to review recent activity on their accounts and rotate their access tokens. Hugging Face did not immediately respond to a request for comment.

Hugging Face says an AI agent carried out an end-to-end cyberattack

Why it matters: The breach appears to be one of the first documented cases of an AI agent driving a cyberattack -- marking a shift from AI-assisted hacking to AI-led operations. Driving the news: Hugging Face said in a blog post late last week that it caught an intrusion in part of its production environment that was "driven, end to end, by an autonomous AI agent system." * Hugging Face said the AI agent framework executed tens of thousands of automated actions. * Over the course of a weekend, the attacker's agents uploaded a malicious data set, exploited vulnerabilities in Hugging Face's data-processing pipeline, escalated its privileges and stole cloud and other sensitive internal credentials. Threat level: The company said it hasn't seen evidence of the attacker tampering with public, user-facing models, datasets, its cloud-hosted platform Spaces and its broader software supply chain. The big picture: Previous attacks used AI to generate code, write phishing emails or automate individual tasks. * Hugging Face says this attack used an autonomous agent system to execute the intrusion from start to finish. The intrigue: Hugging Face says AI helped detect the intrusion and later reconstruct how it happened. * When it first started analyzing the attack, Hugging Face turned to frontier models, but their safety guardrails blocked tasks tied to malware analysis and incident-response analysis. * Then, Hugging Face turned to GLM-5.2, a recently released Chinese open-weight model, and ran it on its own infrastructure to analyze the malware locally without safety restrictions. * "The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment," Hugging Face wrote in its blog post. Yes, but: The Trump administration is weighing a ban on open-source models, sources tell Axios. Between the lines: The incident offers an early glimpse of the future many cybersecurity experts have been anticipating: One where defenders use their own AI tools to quickly detect and stop adversaries' AI tools. * But it will take time for defenders to find and build the right AI tools to fend off all of the attacks coming their way -- especially as both nation-state hackers and cybercriminals start to develop their own multi-modal AI harnesses. What to watch: HuggingFace is investigating whether the intruders accessed customer or partner datasets. * The company also has not publicly attributed the attack or what kind of model was used. Go deeper: AI-powered cybercrime is getting easier

AI guardrails blocked Hugging Face's defenders | VentureBeat

Hugging Face's incident response team first turned to frontier AI models to analyze a breach of the company's production infrastructure, and the models refused to help. Commercial safety guardrails built to stop attackers blocked every forensic query because they treated the IR team's real exploit data the same way they would treat a live attack. The attacker, an autonomous AI agent running the campaign end to end, moved laterally across the Hugging Face infrastructure for a weekend, undetected and unstopped. Security leaders are quick to recognize the pattern and diagnose what went wrong. "I've seen versions of this during red-team exercises and internal security testing, but this is one of the first high-profile examples where it materially affected real incident response," said Merritt Baer, senior adviser to Andesite, G2I, and AppOmni and former Deputy CISO at AWS. None of this is unique to Hugging Face, Baer said. "Commercial frontier models optimize for preventing misuse. They generally have no cryptographic or organizational way to determine whether the person asking 'analyze this malware' is an incident responder or the malware author." A malicious dataset opened two code-execution paths On July 16, Hugging Face disclosed that an autonomous AI agent system had compromised its production infrastructure, gaining unauthorized access to a limited set of internal datasets and several service credentials. The company verified that its software supply chain was clean and found no evidence of tampering with public models, datasets, or Spaces. Hugging Face is still assessing whether the intrusion touched any partner or customer data and says it will contact affected parties directly as required. But few enterprise threat models had accounted for the attacker Hugging Face faced. An autonomous agent ran the entire campaign from initial access through credential harvesting. No human guided it. The entry point was a malicious dataset. When the data-processing pipeline ingested it, the dataset triggered code execution in two ways, through a remote-code loader and through a template-injection flaw in dataset configuration files. No admission gate screened the file before it reached a processing worker, the compute job assigned to each dataset. Initial access came through the data pipeline itself, a route that worked because most enterprise security teams treat the data feeding their pipelines as trusted input rather than an attack surface. Worker isolation did not hold. From that first foothold, the agent broke out onto the node running the workload, then harvested cloud and cluster credentials scoped broadly enough to reach multiple internal clusters, all of it inside a single weekend. Hugging Face described the agent framework as executing thousands of individual actions through a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. The disclosure adds that the framework appeared to be built on an agentic security-research harness, which would put tooling designed for red-team work behind a live intrusion. Why the defenders' queries looked like attacks Investigators reconstructed more than 17,000 recorded events using AI-driven analysis agents of their own. First attempts at the log analysis ran on frontier models behind commercial APIs. Defenders' steps included submitting real attack commands, exploit payloads, and command-and-control artifacts for classification, but safety guardrails blocked the requests outright. Baer traced the block to the prompts themselves. "The same prompts that are most valuable during an active intrusion, shell commands, exploit chains, credential dumps, persistence mechanisms, lateral movement, are exactly the prompts most likely to trigger safety systems," she told VentureBeat. "As AI becomes embedded in security operations, this becomes an operational resilience issue rather than merely a model policy issue." The forensic analysis finished on GLM 5.2 GLM 5.2, an open-weight model deployed on Hugging Face's own infrastructure, took the job the commercial APIs refused. No attacker data left the company's environment. "This experience points to a gap worth planning for," the company wrote in its disclosure. Hugging Face does not know which model powered the agents. It could have been a jailbroken hosted model or an open-weight model running without restrictions. Either way, the disclosure continued, "the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried." Hugging Face drew that line itself, writing that the experience is not an argument against safety measures on hosted models and that it is sharing the feedback with the providers concerned. What authenticated trust changes The industry, Baer argued, needs to move past treating AI safety as a content moderation problem. "Security operations require something different. Authenticated trust." Instead of asking whether anyone should receive an answer, the question becomes whether an authenticated security team, operating under enterprise controls, should receive it. "The model shouldn't only understand what is being asked. It should understand who is asking, why, and under what governance." "Organizations already build contingency plans for cloud outages, identity provider failures, or EDR failures," Baer wrote. "AI assistants are becoming another dependency." Her advice on IR playbooks was blunt. "A mature incident response plan should assume that during a severe incident, commercial AI APIs may refuse requests, API rate limits may become unavailable, internet connectivity may be impaired, and data governance rules may prohibit uploading forensic evidence externally." The lesson, she wrote in her emailed answers, "isn't 'don't use commercial models.' It's 'don't make them a single point of failure.'" AI-enabled attacks rose 89% year-over-year Autonomous AI-driven attacks are not limited to AI platforms. CrowdStrike's 2026 Global Threat Report documented AI-enabled adversary operations increasing by 89% year over year, with average breakout times falling to 29 minutes. Enterprises running AI workloads in production with agentic access to their pipelines face similar exposure. Six control domains determined the blast radius and recovery speed at Hugging Face. Each one maps to a concrete action security leaders can take before the next autonomous-agent breach arrives. AI Pipeline Breach Response Playbook The board question is operational resilience "The question for directors is simple. What happens if one of our critical security tools becomes unavailable during the exact moment we need it most?" Baer framed that as operational resilience, not AI policy. She would have boards take that framing straight to management and press for specifics. "Have we actually exercised that fallback during tabletop exercises? How quickly can we switch during an incident?" Procurement needs to change alongside governance, starting with the questions buyers ask. Security teams evaluating AI vendors should ask about their process for authenticated incident responders, whether enterprise customers receive different handling during verified incidents, and whether models can be deployed privately. "Those questions belong alongside uptime, privacy, and compliance," Baer said. "The biggest takeaway isn't that safety guardrails are 'bad.' They're doing what they were designed to do," she argued. Her larger point is that the threat model itself has changed. "For decades, defenders had better tools than attackers because they operated inside trusted enterprise environments. With foundation models, both sides increasingly use the same capabilities, but one side is constrained by enterprise governance, policy, compliance, and safety controls, while the adversary simply downloads an uncensored open-weight model and keeps going. That's a new kind of asymmetry," she added. "The organizations that handle it best won't necessarily be the ones with the most powerful AI. They'll be the ones that architect AI as a resilient security capability rather than a single cloud service." Hugging Face has contained the intrusion, rebuilt compromised nodes, rotated credentials, and reported the incident to law enforcement. The company recommends that all users rotate access tokens and review recent account activity. Mid-incident, Hugging Face found out whether its own AI tooling would be available, and the first answer was no. Security leaders running AI in production should find out in incident response planning instead, before an autonomous agent forces the test.

'This one was different from anything we had handled before': Hugging Face confirms it was hit by cyberattack powered by an AI agent

* Hugging Face discloses cyberattack where malicious code hidden in a dataset exploited flaws in its systems, enabling privilege escalation and credential theft * The incident was unique in being orchestrated end‑to‑end by an autonomous AI agent, which launched thousands of short‑lived sandboxes and migrated C2 infrastructure across public services * No customer data or public models were tampered with, but the attack highlights the emerging "agentic attacker" scenario long predicted by the industry Hugging Face, one of the biggest platforms for artificial intelligence (AI) and machine learning (ML), disclosed recently suffering a cyberattack supercharged by an AI agent. "This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own," Hugging Face explained in its announcement, noting that the attackers hid malicious code inside a dataset, which they then uploaded to the platform. When Hugging Face's automated systems processed that dataset, they exploited two software flaws which allowed the attackers' code to run on one of the company's servers. Orchestrated by an autonomous AI agent This twist to the classic code injection attack allowed the attackers to expand their privileges and gain more control over the system, steal authentication credentials to access Hugging Face's cloud infrastructure, and pivot to other internal systems. But carrying the attack out mostly with an AI agent is what made this incident unique, Hugging Face explained. Instead of a human threat actor typing commands, Hugging Face believes the attack was orchestrated by an AI-powered autonomous agent which, entirely on its own, decided which systems to probe, which vulnerabilities to exploit, which credentials to steal, and how to move laterally throughout the compromised infrastructure. "The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services," Hugging Face explained. "This matches the "agentic attacker" scenario the industry has been forecasting." In other words, the agent kept launching thousands of temporary computing environments, making it extremely hard to stop the attack (since there isn't a single machine to block). At the same time, the infrastructure controlling the malware kept moving, likely by using legitimate public cloud or online services. Therefore, when the defenders blocked one control server, the attacks would simply come from another. Currently there is no evidence of tampering with customer data, public user-facing models, or Spaces. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Hugging Face says it resorted to a Chinese AI model to battle a fully autonomous cyberattack because U.S. model guardrails hampered its defense | Fortune

A blogpost from Hugging Face, a company that hosts open source AI models and leaderboards, has stirred up the AI world for two reasons. First, the company said it had come under a cyber attack from a fully autonomous AI agent that swarmed its system with "tens of thousands of automated actions." Experts have been warning that AI agents are quickly becoming capable enough to carry these sorts of autonomous attacks -- but the Hugging Face hack appears to be among the first real world examples. That disclosure would normally be news-worthy in and of itself. But what Hugging Face said it did next has received even more attention: the company fought AI with AI, using a Chinese-built open-source model to detect the attack and understand its scope. Hugging Face said it turned to the Chinese model -- Z.ai's GLM 5.2 -- after its security team initially tried to use an unnamed frontier AI model from one of the leading U.S. AI companies but found it was unable to do so because of the model's guardrails. The company said in its blog post that these models "cannot distinguish an incident responder from an attacker." That claim was bound to generate a lot of buzz at a time when many in Silicon Valley and Washington, D.C., are deeply worried about the speed of Chinese AI advances. These concerns have been heightened by last week's debut of Kimi K3, an advanced open-source AI model from Chinese AI startup Moonshot. Some venture capitalists and AI policy analysts who want to see the U.S. do everything possible to accelerate American AI progress in order to stay ahead of China worry that too much emphasis on AI safety, both within the leading U.S. labs and in policy circles, is holding back U.S. progress. In June, the Trump administration used export controls to block the distribution of Anthropic's Fable 5 and Mythos 5 models after it received reports of a jailbreak in Fable's guardrails around cyber tasks. It also initially asked OpenAI to restrict the release of its GPT-5.6 Sol model until OpenAI could offer assurances its guardrails around cyber capabilities were also robust. David Sacks, the former Trump administration AI and crypto czar, posted the Hugging Face example on social media platform X.com and said, "There's no reason to limit American models on tasks that Chinese models handle without issue. We're only making ourselves less competitive." Referring to the Hugging Face incident specifically he said, "The guardrails actually impaired defensive security." Hugging Face CEO Clem Delangue, whose business is built around open source AI and who has previously spoken out against any U.S. policy that would restrict such models for security and safety reasons, told Fortune that the proprietary models from leading U.S. AI companies are actually dangerous to use to defend against a cyber attack. "When you're in the middle of an active incident, you can't have your tools refusing to examine malicious payloads or getting your account flagged," he said. "Open models let us do that work without asking anyone's permission." Although the lack of guardrails on some AI systems may seem risky, Delangue argues it's necessary to meet attackers on their level. "Attackers are already using agents, and they obviously don't respect any guardrails," he said. "Defenders need the same capabilities, and open-source is the fastest way to put them in everyone's hands, not just the biggest companies." Hugging Face said that from its analysis, the AI agent attacking its systems seems to have acted entirely on its own, without any human initiating the attack or directing its progress. "We believe we caught the attack before the initiating humans were put in the loop, which helped us win that cybersecurity battle more easily," Delangue said. "[This ]shows that speed will be key in cybersecurity defense in the age of agents." Cybersecurity officials have been warning for the past year that increasingly powerful AI agents would soon be able to carry out autonomous cyber attacks at speeds and scale that could overwhelm conventional cybersecurity methods. But the Hugging Face incident appears to be among the first of a small number of real world autonomous AI cyber attacks that have been documented. Earlier this month, cybersecurity company Sysdig said it had documented the first completely autonomous ransomware attack in the real world. It dubbed the AI agent that carried out the attack and the method it used "Jadepuffer." This week Sysdig said it had discovered a new version of Jadepuffer ransomware that specifically targeted trained AI models sitting on corporate networks. These models are considered valuable ransomware targets as they are expensive to train and may not have back-up copies. To combat the attack it was experiencing, Hugging Face said it used GLM 5.2 running on its own infrastructure to analyze more than 17,000 logs, or footprints, that the attackers left behind. The company said the attacking AI agent entered its systems through Hugging Face's data-processing pipeline, a "uniquely exposed" part of AI platforms. It then set up a series of temporary sandboxes, or disposable coding environments in the cloud, where it executed its plan. The company then fixed the vulnerability, kicked out the attacker, and improved its detection and security guardrails. "Cybersecurity is always a race between finding and patching exploits," Delangue said. "AI systems change how this race is run with a different attack surface. Hopefully this will be an example for other organizations to follow to boost up their own defenses." Hugging Face said it is still investigating the impact of the attack, and does not know which large language model powered it. The attacker broke into a limited set of internal datasets and credentials, but Hugging Face is still working on assessing the full scope of the attack. The company said it plans to contact any affected parties directly. So far, it has not found any evidence of tampering with public, user-facing models, it said. GLM 5.2 was released in mid-June by Beijing-based Z.ai, and is the company's new flagship model. It made waves in Silicon Valley for being on-par with Anthropic's Claude Opus 4.8 and OpenAI's GPT-5.5, Business Insider reports. Chinese AI companies have continuously kept the American industry on its toes, beginning with DeepSeek R1 in 2025, and most recently with this month's release of Kimi K3. Both are open source.

The Hugging Face Breach Is a Warning for Every Company Betting Big on AI

Hugging Face has been hacked -- and the perpetrator was an AI agent. A GitHub-like platform and community for open-source AI models and data, Hugging Face published a blog post on Friday disclosing the breach. Perhaps the most shocking part was Hugging Face's disclosure that the hack was likely carried out by an autonomous agent framework. "The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions," the blog reads. "This matches the 'agentic attacker' scenario the industry has been forecasting." As AI has grown more sophisticated, experts have begun warning that it will make sophisticated cyberattacks cheaper and easier to pull off. Agentic AI in particular is expected to enable cybercriminals to enlist agents to do their dirty work at machine speed. This prediction has already proven true, and the attack on Hugging Face is just one more example.

Hugging Face Latest Company Dealing With AI Cyberattacks | PYMNTS.com

As TechCrunch reported Monday (July 20), the company revealed the breach last week but said it was still determining if any customer or partner data had been stolen. On its blog, Hugging Face said a dataset uploaded to its platform exploited a security vulnerability to run malicious code on its servers, letting hackers escalate their permissions and obtain broader access to the company's internal systems. "The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services," the blog post said. "This matches the 'agentic attacker' scenario the industry has been forecasting." Hugging Face says it has revoked and rotated the stolen credentials that were accessed and implored users to do the same with their access tokens and to review suspicious activity on their accounts. The TechCrunch report noted that although it's not unusual for hackers to try to access a company's network with things like stolen credentials or security weaknesses, this incident highlights the challenges companies like Hugging Face encounter when cybercriminals try to abuse platforms and tools to swipe sensitive data from within. With this breach, Hugging Face joins a host of other companies who have reported or been affected by cyber incidents this year, amid a surge in artificial intelligence (AI)-related attacks, as PYMNTS wrote last week. At the time, Fairlife, a dairy company owned by The Coca-Cola Co., had reported a ransomware event that impacted its systems. "After detecting the issue, the company promptly activated its incident response and business continuity protocols," Coca-Cola said in a news release. "The company's investigation and assessment of the impact of the incident is ongoing, with the assistance of outside advisers and cybersecurity experts. The company has also notified law enforcement." The FBI's Internet Crime Complaint Center (IC3) said in April that it received 22,364 internet crime complaints containing references to AI last year, leading to losses of $893 million. "AI-enabled synthetic content is becoming increasingly difficult to detect and easier to make, which allows criminal actors to potentially conduct successful fraud schemes against individuals, businesses and financial institutions," the FBI said in its 2025 Internet Crime Report. Meanwhile, the PYMNTS Intelligence report "Is That Content Generated by AI or Humans? Hard to Tell" found that AI-created content can deceive both humans and AI systems, leaving businesses and regulators scrambling to address the growing threat.

Hugging Face discloses production breach: malicious dataset accessed systems

Internal data and service credentials were exposed, not public models Hugging Face runs a hosting platform for AI models and datasets. In mid-July 2026, it said an autonomous software agent had used a malicious dataset to get into Hugging Face production systems, exposing internal data and service credentials. According to Hugging Face, the attacker abused two code-execution paths in its dataset-processing pipeline. That gave the agent room to raise its privileges, collect credentials, move from cluster to cluster, and rack up thousands of actions by hopping through short-lived sandboxes and self-migrating command-and-control infrastructure. If you depend on Hugging Face's massive repository of models and datasets, this lands as both a software supply-chain problem and a platform problem. Hugging Face says it detected and contained the breach in mid-July 2026, then closed the flaws, rebuilt the affected systems, revoked compromised credentials, and stepped up monitoring. So far, it says it has found no evidence that public models, datasets, or user-facing apps were changed. The investigation, though, is still underway. If you use Hugging Face regularly, now's a good time to rotate your access tokens and review recent activity. You can also check the company's security advisory on the platform itself. The incident comes after a June 2024 exposure of authentication secrets that Hugging Face had already disclosed, and it adds to the broader warning signs around autonomous attacks and the weak spots in trusted data pipelines.

HuggingFace hacked: How RCE Dataset Loader exploited AI playground

This is what is going on in the supply chain for AI: the very thing that we all generally think of as a passive item, a dataset, a folder full of information stored on a server, can actually be the mechanism that allows for code execution. That is what recently occurred at Hugging Face, and it should scare everyone who brings datasets into their pipelines without further consideration. Also read: Rise of Friendslop games: Best couch co-op games you need to try Hugging Face noticed and responded to an intruder accessing certain parts of their production infrastructure, calling the attack different in kind than others in that it was driven by an autonomous AI agent system, end to end, detected mainly through Hugging Face's own AI tools. They say there was unauthorized access to a certain number of internal datasets and credentials associated with their services, and are evaluating the extent to which partner or customer data was compromised. Their public models and Spaces remained intact. What is most interesting about this attack vector is the entry point. This breach began when a malicious dataset leveraged two methods of executing code - a dataset loader with remote code execution capabilities and the template injection vulnerability in the dataset configuration - to execute code in the processing worker. After that initial foothold, the attacker used the node access gained to escalate privileges to steal cloud and cluster credentials and move horizontally across multiple internal clusters in less than a week's time. Simplistically, a dataset loader is simply a tool that takes a dataset, loads it, and then prepares it for use by the model. However, certain loader tools have the capability to run scripts that have been bundled along with the dataset. While convenient, this capability is also the attacker's avenue of entry. Since the loader is going to run any kind of code to prepare the dataset, the dataset itself ceases to be just the dataset. It becomes a payload delivered through a delivery method that trusts it implicitly. The template injection attack adds to this issue by allowing the attacker to sneak in malicious code within an apparently harmless configuration file. Also read: Netflix used generative AI on 300 titles this year, and there's no rulebook What made this event exceptional is not just the incident report but also who exactly was responsible for it. The attack was perpetrated by an autonomous agent architecture, most likely based on an agentic security research harness, performing thousands of separate actions through a swarm of short-lived sandboxes, with self-migrating command-and-control being performed via public services. Hugging Face refers to this scenario as the "agentic attacker" that the industry had long anticipated, and the only thing I would disagree with here is in considering this threat novel just because it uses a different approach to credential harvesting and lateral movement. In fact, there is an exceptionally awkward part of this story. When trying to analyze 17,000+ logged actions of the attacker by utilizing frontier models available through commercial APIs, safety guardrails on the APIs prevented the analysis because of the nature of the request involving exploitation of a real attack. As a result, Hugging Face had to resort to analyzing the data with a general purpose model called GLM 5.2 running on their own infrastructure. This is a truly valuable, albeit somewhat ironic, lesson for defenders around the world, since the same safety rail designed to protect against misuse can end up stopping defenders in their tracks too. As Hugging Face recommends, you should be prepared in advance by deploying a capable, self-hosted model before the event takes place. From a developer/AI team standpoint for those routinely using datasets from Hugging Face, it is important to note that this is a lesson in good coding practices rather than a cause for panic. It is crucial to treat Hugging Face data loader in the same manner that you would any untrusted third-party code. Also, do not assume that "it's only a dataset," therefore there is no problem.