Hugging Face hit by AI agent intrusion in production

Hugging Face has disclosed an intrusion into part of its production infrastructure, saying the incident was carried out by an autonomous AI agent system.

It found unauthorised access to a limited set of internal datasets and several credentials used by its services. The company is still assessing whether any partner or customer data was affected and said any affected parties would be contacted directly.

Hugging Face said it found no evidence of tampering with public user-facing models, datasets or Spaces. It also said its software supply chain, including container images and published packages, had been verified as clean.

According to the disclosure, the attack began in the company's data-processing pipeline. A malicious dataset exploited two code-execution paths in dataset processing - a remote-code dataset loader and a template injection in a dataset configuration - to run code on a processing worker.

From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. Hugging Face said the campaign involved many thousands of individual actions across a swarm of short-lived sandboxes, with command-and-control infrastructure staged on public services.

Detection and response

Hugging Face said it detected the intrusion with AI-assisted systems and then used AI tools in its investigation. Its anomaly-detection pipeline uses large language model-based triage over security telemetry to sort significant signals from routine activity, and correlating those signals flagged the compromise.

To reconstruct the incident, the company said it ran analysis agents over a log of more than 17,000 recorded events. That allowed investigators to rebuild the timeline, identify indicators of compromise, map the credentials that had been touched, and distinguish genuine impact from decoy activity.

"This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own," said Hugging Face.

Hugging Face said it had closed the dataset code-execution paths used for the initial access. It also said it had removed the attacker's foothold across affected clusters, rebuilt compromised nodes, revoked and rotated affected credentials and tokens, and begun a broader precautionary rotation of secrets.

Additional controls have been introduced on clusters, including stricter admission controls and changes to detection and alerting. Hugging Face said it had worked to ensure that a high-severity signal would page a responder within minutes at any time of the week.

Guardrail issue

During the forensic work, the company said it first turned to frontier models accessed through commercial application programming interfaces. That approach failed because the analysis required submitting real attack commands, exploit payloads and command-and-control artefacts, and those requests were blocked by the providers' safety guardrails.

Hugging Face said it instead carried out the forensic analysis using GLM 5.2, an open-weight model run on its own infrastructure. That also meant attacker data, and the credentials referenced in that data, did not leave its environment.

The episode highlights a problem security teams may face as they adopt AI in incident response. Hosted models may refuse to process material that resembles offensive cyber activity, even when the task is defensive forensic analysis.

"The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment," said Hugging Face.

Hugging Face said it does not yet know which model powered the attacker's agents, or whether the system relied on a jailbroken hosted model or an unrestricted open-weight one. It said the asymmetry left attackers unconstrained by usage policies while its own responders were initially blocked by hosted model guardrails.

Outside cybersecurity forensic specialists are involved in the investigation, according to the company. Hugging Face also said it had reported the incident to law enforcement agencies.

As a precaution, the company recommended that users rotate any access tokens and review recent activity on their accounts. "We are grateful to the teams across Hugging Face who responded around the clock, and we are sorry for any disruption this caused. Security is never finished; we will keep raising the bar," said Hugging Face.