Hugging Face Says Autonomous AI Agent System Breached Production Infrastructure

Summary

Hugging Face disclosed a breach of its production infrastructure, attributed to an autonomous AI agent system. The attacker exploited vulnerabilities in the dataset processing system to gain access to internal data and service credentials. While public models and packages were unaffected, the company is investigating potential customer data impact.

Full text

Security Artificial Intelligence Cyber Attacks Data BreachesHugging Face Says Autonomous AI Agent System Breached Production Infrastructure An AI-led cyberattack breached limited Hugging Face datasets and service credentials, while public models, Spaces and published packages showed no signs of tampering. byWaqasJuly 20, 20263 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening Hugging Face, an open-source platform and community often described as the “GitHub of Machine Learning,” has disclosed unauthorized access to part of its production infrastructure in an attack the company says was carried out from start to finish by an autonomous AI agent system. The attacker accessed a limited set of internal data and several credentials used by Hugging Face services. The company is still determining whether any customer or partner data was affected and said it will contact relevant parties if required. According to its security incident disclosure, investigators found no evidence that public models, datasets, or Spaces were modified. Hugging Face also verified that its published packages and container images remained clean. Malicious Dataset Opened Access to Internal Systems The attack began when a malicious dataset exploited two code execution paths in Hugging Face’s dataset-processing system. One involved a remote-code dataset loader, while the other used template injection within a dataset configuration. After gaining code execution on a processing worker, the attacker obtained node-level access and collected cloud and cluster credentials. Those credentials were then used to move into several internal clusters during a weekend. Hugging Face said the activity differed from previous incidents because an autonomous agent framework handled the operation end to end. The system performed thousands of individual actions through short-lived sandboxes and used public services to host a self-migrating command-and-control setup. Researchers believe the framework may have been based on an agentic security research harness, although the language model controlling it remains unknown. Hugging Face could not determine whether the attacker used a jailbroken commercial model or an unrestricted open-weight model. Hugging Face Used AI to Reconstruct the Attack After detecting the compromise, Hugging Face removed the attacker’s access, rebuilt affected nodes, and revoked exposed credentials and tokens. The company also began rotating other secrets as a precaution and introduced stricter admission controls for its internal clusters. Investigators used language models to examine more than 17,000 recorded events. The analysis reconstructed the timeline, identified indicators of compromise, mapped which credentials had been accessed, and separated genuine activity from decoys in hours, compared with days normally required for this type of work. However, commercial AI model APIs presented an unexpected obstacle during the investigation. Requests containing exploit commands, malicious payloads, and command-and-control artifacts were blocked by safety controls, even though Hugging Face submitted the material for forensic analysis. To continue, Hugging Face ran GLM 5.2, an open-weight model, on its own infrastructure. This kept attack data and referenced credentials within the company’s environment while allowing investigators to examine the full event record. Public Models Show No Evidence of Tampering Rohit Valia, CEO of cybersecurity company Tumeryk, said organizations using open-source model repositories should look beyond conventional code scanning. He recommended testing models for behavioral drift and verifying their origin and integrity, especially when they are used for training or fine-tuning. Valia also pointed to AI trust scores and the Cloud Security Alliance’s RiskRubric v2 as options for repeatable model testing. Hugging Face, however, said its investigation found no evidence that public models or datasets were altered during this attack. Advice for Hugging Face Users For Hugging Face users, the company recommends rotating access tokens and reviewing recent account activity for unfamiliar actions. Suspected misuse can be reported to [email protected]. The investigation remains active with help from outside forensic specialists, and Hugging Face has reported the case to law enforcement. The company has not identified the attacker or disclosed how many credentials and internal datasets were accessed. Waqas I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cybersecurity and tech world. I am also into gaming, reading and investigative journalism. View Posts Agentic AIAI AgentsArtificial IntelligenceCyber AttackCyber CrimeCybersecuritydata breachHugging FaceMachine Learning Leave a Reply Cancel reply View Comments (0) Related Posts Read More Security Scams and Fraud Fake version of note sharing site Privnote.com stealing users’ Bitcoin A fake version of popular encrypted messages web service Privnote.com that’s redirecting user’s cryptocurrency to scammers. byWaqas Read More Security Malware Counter-Strike 1.6 game client 0-day exploited to spread Belonard trojan Dr. Web’s cybersecurity researchers have identified an attacker is trying to exploit zero-day vulnerabilities in Counter-Strike 1.6 game… byWaqas Read More Security Malware COOKIE SPIDER’s Malvertising Drops New SHAMOS macOS Malware CrowdStrike reports COOKIE SPIDER using malvertising to spread SHAMOS macOS malware (a new variant of AMOS infostealer), stealing… byWaqas Read More News Security Technology Crucial Cybersecurity Software Features (2022) Cyberattacks aim to breach device, program, and system defenses to access critical company or individual data. If a… byOwais Sultan

Indicators of Compromise

• mitre_attack — T1204.002
• mitre_attack — T1078.004
• mitre_attack — T1071

Entities