Hugging Face hit by fully autonomous AI agent attack

Hugging Face confirmed a breach of its production infrastructure carried out entirely by an autonomous AI agent system — what the company calls the ‘agentic attacker’ scenario the industry has been predicting for years. The attackers used a malicious dataset as an entry point, exploiting two code execution paths in the platform’s data processing pipeline. From there, they escalated to node level, harvested cloud and cluster credentials, and moved laterally across multiple internal clusters over a weekend. An autonomous agent framework built on a security research harness orchestrated the entire campaign, executing thousands of individual actions through a swarm of short-lived sandboxes with self-migrating command-and-control infrastructure.

The company says public models, datasets, and Spaces were untouched, and the software supply chain wasn’t affected. Whether partner or customer data was compromised remains under investigation. Hugging Face doesn’t know which language model powered the attack — it could have been a jailbroken hosted model or an unrestricted open-weight one. What’s clear is the attacker operated with no usage policy constraints.

To analyze more than 17,000 recorded attacker actions, Hugging Face deployed its own LLM-driven analysis agents. Those tools reconstructed the timeline, extracted indicators of compromise, mapped affected credentials, and separated real damage from deception activity. Work that would normally have taken days was done in hours. But the forensic effort hit an unexpected snag: when the security team first tried using frontier models behind commercial APIs, safety guardrails blocked the requests. The providers couldn’t distinguish an incident responder from an attacker when faced with real exploit payloads and C2 artifacts. Hugging Face pivoted to the open-weight model GLM 5.2 running on its own infrastructure, which kept sensitive data in-house and avoided the filter problem.

The company has shut down the exploited code paths, revoked access, rebuilt compromised nodes, and rotated credentials. External forensics experts and law enforcement are involved. Hugging Face recommends all users rotate their access tokens and review account activity. The incident validates that autonomous AI attack tools aren’t theoretical anymore — they lower the cost of multi-stage campaigns and operate at machine speed. The practical lesson is stark: organizations need capable models running on their own infrastructure before an incident happens, not after.