Hugging Face, the world’s biggest hub for open-source AI models, got hit by a cyberattack. The attacker was an autonomous AI agent.

The breach happened last week. Luckily, Hugging Face caught it fast and jumped into action. 

Hugging Face

Hugging Face runs one of the largest platforms for sharing AI models and datasets. Millions of developers use it every day.

Sometime last week, the company noticed unauthorized access to its production systems. In a public statement, Hugging Face said the attacker got into a limited set of internal datasets. 

They also grabbed several credentials used by company services. The good news is that an investigation is still underway. 

But so far, no evidence shows the attacker touched public models, datasets, or Spaces. The software supply chain also looks clean. 

The Attack

The attacker uploaded a malicious dataset. That dataset exploited two weak points. One was in the remote code dataset loader. 

The other involved a template injection hidden inside a dataset configuration file. Together, these flaws let the attacker run code on a processing worker. 

Once inside, the intruder escalated their access to the node level. From there, they scooped up cloud and cluster credentials. Then they moved sideways through several internal clusters. 

This all happened over the course of a single weekend.

 AI Agents

Hugging Face said the campaign came from an autonomous agent framework. This system performed thousands of individual actions that spread across a swarm of short-lived sandboxes.

The attacker used self-migrating command-and-control setups. These were staged on public services, making them harder to trace and shut down.

Nobody knows exactly which large language model powered this operation. That mystery remains unsolved for now. But the scale and speed of the attack point to major automation. 

The Fix

First, engineers shut down the code execution pathways that allowed the initial break-in. That closed the front door the attacker had used.

Next, they cleared out the attacker’s presence across every affected cluster. Compromised nodes got rebuilt from scratch.

Hugging Face also revoked and rotated every credential and token that may have been exposed. 

As an extra precaution, the company rotated a much wider set of secrets across its systems. On top of that, new guardrails and stricter access controls are now in place across the clusters.

Detection systems got an upgrade to catch the next threat within minutes, any time of day or night.

Hugging Face is also asking customers to take action. If you use the platform, rotate your access tokens. Take a few minutes to review recent activity on your account. 

Surprise Wall

When Hugging Face tried to investigate the attack, they hit a wall. Their first choice of AI models refused to help.

Because those systems were built by major Western AI labs and wouldn’t process real attack commands, exploit code, or command-and-control data. 

Their safety filters kicked in and blocked the requests. The models couldn’t tell the difference between a hacker and a security team trying to clean up the mess.

So Hugging Face turned elsewhere. They used GLM 5.2, an open-weight model made by the Chinese company Z.ai. That model didn’t block the forensic work; it got the job done.