Hugging Face reports AI-driven intrusion on its platform
The company disclosed that an autonomous AI-agent system breached its infrastructure, and it used its own AI tools to investigate and remediate the incident.
Hugging Face said an autonomous AI-agent system infiltrated part of its production environment earlier this month. The breach began with a malicious dataset that exploited two flaws in the firm’s data-processing pipeline, allowing the attacker to execute code on a processing worker, gain node-level access and harvest cloud and cluster credentials over a weekend.
The company’s blog post described the campaign as being run by an “autonomous agent framework… executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services.”
To detect and analyze the intrusion, Hugging Face employed its own AI models, examining more than 17,000 recorded events to reconstruct the timeline, identify exposed credentials and separate genuine damage from decoy activity. The firm said the AI-assisted analysis took about an hour, a task that would normally require days.
After the investigation, Hugging Face reported that no public-facing models, datasets or Spaces were altered and that there is no evidence of customer data being compromised. It has patched the exploited vulnerabilities, revoked and rotated affected credentials, rebuilt compromised nodes and engaged external cybersecurity experts. The incident has been reported to law-enforcement agencies, and users are advised to review recent account activity and rotate access tokens.