Press play to start listening
Hugging Face, an open-source platform and community often described as the “GitHub of Machine Learning,” has disclosed unauthorized access to part of its production infrastructure in an attack the company says was carried out from start to finish by an autonomous AI agent system.
The attacker accessed a limited set of internal data and several credentials used by Hugging Face services. The company is still determining whether any customer or partner data was affected and said it will contact relevant parties if required.
According to its security incident disclosure, investigators found no evidence that public models, datasets, or Spaces were modified. Hugging Face also verified that its published packages and container images remained clean.
Malicious Dataset Opened Access to Internal Systems
The attack began when a malicious dataset exploited two code execution paths in Hugging Face’s dataset-processing system. One involved a remote-code dataset loader, while the other used template injection within a dataset configuration.
After gaining code execution on a processing worker, the attacker obtained node-level access and collected cloud and cluster credentials. Those credentials were then used to move into several internal clusters during a weekend.
Hugging Face said the activity differed from previous incidents because an autonomous agent framework handled the operation end to end. The system performed thousands of individual actions through short-lived sandboxes and used public services to host a self-migrating command-and-control setup.
Researchers believe the framework may have been based on an agentic security research harness, although the language model controlling it remains unknown. Hugging Face could not determine whether the attacker used a jailbroken commercial model or an unrestricted open-weight model.
Hugging Face Used AI to Reconstruct the Attack
After detecting the compromise, Hugging Face removed the attacker’s access, rebuilt affected nodes, and revoked exposed credentials and tokens. The company also began rotating other secrets as a precaution and introduced stricter admission controls for its internal clusters.
Investigators used language models to examine more than 17,000 recorded events. The analysis reconstructed the timeline, identified indicators of compromise, mapped which credentials had been accessed, and separated genuine activity from decoys in hours, compared with days normally required for this type of work.
However, commercial AI model APIs presented an unexpected obstacle during the investigation. Requests containing exploit commands, malicious payloads, and command-and-control artifacts were blocked by safety controls, even though Hugging Face submitted the material for forensic analysis.
To continue, Hugging Face ran GLM 5.2, an open-weight model, on its own infrastructure. This kept attack data and referenced credentials within the company’s environment while allowing investigators to examine the full event record.
Public Models Show No Evidence of Tampering
Rohit Valia, CEO of cybersecurity company Tumeryk, said organizations using open-source model repositories should look beyond conventional code scanning. He recommended testing models for behavioral drift and verifying their origin and integrity, especially when they are used for training or fine-tuning.
Valia also pointed to AI trust scores and the Cloud Security Alliance’s RiskRubric v2 as options for repeatable model testing. Hugging Face, however, said its investigation found no evidence that public models or datasets were altered during this attack.
Advice for Hugging Face Users
For Hugging Face users, the company recommends rotating access tokens and reviewing recent account activity for unfamiliar actions. Suspected misuse can be reported to [email protected].
The investigation remains active with help from outside forensic specialists, and Hugging Face has reported the case to law enforcement. The company has not identified the attacker or disclosed how many credentials and internal datasets were accessed.
