Hugging Face disclosed on July 16 that an autonomous AI agent, not a human attacker at a keyboard, drove a breach of its production infrastructure from start to finish, in what security researchers are calling the first fully AI-driven attack on a major AI platform.
The attacker exploited two code-execution flaws in Hugging Face’s dataset-processing pipeline, then escalated to steal cloud and cluster credentials and move across internal systems
The agent logged more than 17,000 individual actions over a single weekend, cycling through disposable sandbox environments and shifting its command infrastructure to dodge takedown attempts
Hugging Face found no evidence that public models, datasets, Spaces, or its software supply chain were tampered with, and access was limited to a set of internal datasets and service credentials
How the attack worked
The intrusion started with a malicious dataset. Hugging Face’s platform routinely runs untrusted, user-submitted code as part of how it processes datasets, and the attacker exploited that by abusing a remote-code dataset loader alongside a template-injection flaw in dataset configuration.
Once the agent gained code execution on a processing worker, it escalated to node-level access, harvested credentials, and moved laterally across multiple internal clusters, all without a human directing each step.
The twist during the investigation
While reconstructing the attack timeline from its 17,000-plus logged actions, Hugging Face tried using commercial frontier AI models to help analyze the forensic data. Those models refused, because their safety systems could not tell the difference between an incident responder submitting real exploit payloads for analysis and an actual attacker.
Hugging Face ended up pivoting to GLM-5.2, an open-weight model it could run entirely on its own infrastructure, which let it complete the analysis without the guardrail lockout and without sending sensitive data to an outside service.
Security researchers are pointing to that moment as evidence of a widening asymmetry. Attackers running jailbroken or unrestricted models face no policy limits at all, while defenders leaning on hosted commercial models can get blocked mid-incident by the very safety systems meant to protect them.
What Hugging Face has done since
The company says it has closed the exploited code paths, rebuilt the compromised nodes, rotated affected credentials, and added stricter controls across its clusters. It has also brought in external forensic specialists and reported the incident to law enforcement.
Hugging Face is advising all users to rotate their access tokens and check recent account activity as a precaution, and says it will notify any affected customers or partners directly once its assessment is complete.
Quick Links:
