Hugging Face announced on July 16 that an autonomous AI agent, not a human attacker at a keyboard, caused a start-to-finish attack on the company’s production infrastructure. Security researchers are calling this the first fully AI-driven attack on a major AI platform.
-
The attacker exploited two code execution errors in Hugging Face’s dataset processing pipeline and then escalated to steal cloud and cluster credentials and move across internal systems
-
The agent logged more than 17,000 unique actions in a single weekend, traversing available sandbox environments and relocating its command infrastructure to evade takedown attempts
-
Hugging Face found no evidence that public models, datasets, spaces, or the software supply chain had been tampered with, and access was limited to a number of internal datasets and service credentials
How the attack worked
The breach started with a malicious data set. Hugging Face’s platform routinely runs untrusted user-submitted code as part of its dataset processing. The attacker exploited this by abusing a remote code dataset loader alongside a template injection flaw in the dataset configuration.
Once the agent gained code execution on a processing worker, it escalated to node-level access, collected credentials, and moved laterally across multiple internal clusters, all without human control at every step.
The twist during the investigation
In reconstructing the attack timeline from over 17,000 logged actions, Hugging Face attempted to use commercial frontier AI models to aid in the analysis of the forensic data. These models refused because their security systems could not distinguish between an incident responder submitting real exploit payloads for analysis and an actual attacker.
Hugging Face eventually moved to GLM-5.2, an open-weight model that could run entirely on its own infrastructure, allowing analysis without guardrails and without sending sensitive data to an external service.
Security researchers point to this moment as evidence of increasing asymmetry. Attackers operating jailbreak or unrestricted models face no policy restrictions, while defenders relying on hosted commercial models can be blocked mid-incident by the very security systems designed to protect them.
What Hugging Face has done since then
The company says it has closed the exploited code paths, recreated the compromised nodes, rotated affected credentials and implemented stricter controls across its clusters. In addition, external forensic specialists were brought in and the incident was reported to law enforcement authorities.
As a precautionary measure, Hugging Face advises all users to change their access tokens and review recent account activity, and says any affected customers or partners will be notified directly once the assessment is complete.
Quick links:
