Hugging Face is one of the world’s leading open-source AI companies. It provides a platform where developers and organizations can build, share, and deploy machine learning and generative AI models.
Hugging Face disclosed that an autonomous AI agent breached part of its production infrastructure last week. The company detected the intrusion, contained it, and found unauthorized access to a limited number of internal datasets and service credentials. The investigation is still ongoing, but there is no evidence the attackers modified public AI models, datasets, Spaces, or the company’s software supply chain.
“We identified unauthorized access to a limited set of internal datasets and to several credentials used by our services. We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required.” states the security incident disclosure. “We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.”
The attack began in Hugging Face’s data-processing pipeline, where a malicious dataset exploited two code execution flaws to compromise a processing worker. The attackers escalated privileges, stole cloud and cluster credentials, and moved laterally across internal systems.
Hugging Face said the operation was driven by an autonomous AI agent framework that executed thousands of actions across short-lived sandboxes and used public services for self-migrating command-and-control, reflecting the rise of AI-powered, agentic attacks.
“The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness – used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services.” continues the company. “This matches the “agentic attacker” scenario the industry has been forecasting.”
Hugging Face closed the vulnerabilities that allowed the initial compromise, removed the attackers’ access, and rebuilt the affected systems. The company revoked and rotated compromised credentials, launched a broader secrets rotation, strengthened security controls across its clusters, and improved monitoring to detect similar attacks within minutes.
