Hugging Face confirms intrusion that compromised internal credentials and attributes attack to autonomous AI agent

Hugging Face has confirmed an intrusion into part of its production infrastructure that allowed unauthorized access to several internal data sets and credentials used by its services. The company assures that still investigating whether customer or partner data was affected and that it will contact the parties involved directly if it finds evidence of exposure.

According to the official communication published on July 16, the attack began with a malicious data set uploaded to the platform. That content took advantage of two paths of code execution within the processing system. On the one hand, a remote dataset loader and, on the other, an injection of templates into a configuration. From there, the attacker managed to escalate privileges until gaining node-level access.

Once inside, those responsible would have collected cloud and cluster credentials and moved laterally to various internal environments over a weekend. Hugging Face claims that it has found no evidence of tampering in public models, datasets or Spaces and that its software supply chain was verified as clean, including published containers and packages.

The company attributes the campaign to an autonomous AI system

The most curious thing is that Hugging Face, which is a platform specialized in AI models, maintains that the operation was executed from start to finish by a framework of autonomous agents. According to their version, the system performed thousands of actions distributed among short-lived isolated environments and used public infrastructure to move its command and control system. The company calls the incident a real example of the “agent” attacker that the sector had long anticipated.

TechCrunch notes, however, that Hugging Face did not provide additional evidence when the outlet asked for evidence to support that attribution. Therefore, the participation of an autonomous agent is part of the company’s official explanation, but has not been independently verified. Hugging Face also does not know which model the attacker would have used or whether it was a hosted and modified system or an open weights one.

The company says its own anomaly detection system identified the attack by correlating security signals using language models. To reconstruct what happened, it analyzed more than 17,000 recorded events and used artificial intelligence agents to sort the timeline, locate indicators of compromise, and determine which credentials had been touched. According to Hugging Face, that process reduced an analysis that would normally have taken days to hours.

The first attempt was made with advanced models available through commercial APIs, but the requests were blocked by their security filters. The analysis included real commands, exploit payloads, and command and control artifacts, elements that vendors interpreted as potentially malicious. Hugging Face ended up running GLM 5.2 on its own infrastructure, which also allowed sensitive logs and credentials to stay in its environment.

Hugging Face asks to rotate tokens and review account activity

After detecting the intrusion, the company closed the vulnerabilities used, eliminated the attacker’s presence, rebuilt the compromised nodes, and revoked the affected credentials. It has also initiated a broader preventive rotation of secrets, tightened access controls for its clusters, and improved alerts so that high-severity incidents reach a responsible person within minutes.

As a preventive measure, Hugging Face recommends its users rotate any access tokens stored on the platform and review recent activity on your accounts for suspicious movements. The company has hired external specialists in forensic analysis, has informed the authorities and keeps the investigation open on the possible impact on customer and collaborator information.

The incident focuses on a particularly sensitive attack surface for artificial intelligence platforms, namely the processes that receive and execute datasets, models and configurations provided by third parties. Hugging Face believes that the main lesson for defenders is to have their own models prepared to respond to incidents, both to avoid blockages by external filters and to keep the most sensitive data of an investigation within the organization.