Hugging Face reveals cyberattack carried out by autonomous AI agents

Hugging Face has disclosed a cyberattack that was carried out entirely by an autonomous AI agent without direct human control, according to a post published by the company.

The attack began with a dataset that exploited two vulnerabilities in Hugging Face's data processing pipeline — a remote code execution loader and a template injection issue in the configuration system — to run code on one of the company's processing servers.

The attacker then gained access at the host level, stole cloud and cluster credentials, and moved between several internal clusters over the weekend.

According to Hugging Face, the attack was carried out by an autonomous agent framework that performed more than 17,000 individual actions across short-lived sandbox environments. The attacker also disguised the command infrastructure as traffic from public services. The company did not disclose which language model powered the operation.

The incident gave attackers access to a limited set of internal datasets and several service credentials. Hugging Face said it found no evidence that public models, datasets, or Spaces were modified, and that its software supply chain — including container images and published packages — remained unaffected. The company is still assessing the potential impact on customer and partner data.

AI tools were also used during the investigation. Hugging Face used an LLM-based anomaly detection system to help sort security signals and language-model agents to analyze activity logs. However, when investigators attempted to analyze real exploits and command infrastructure artifacts through commercial AI APIs, safety filters blocked some requests because the models could not reliably distinguish incident responders from attackers.

The company eventually moved the analysis to GLM 5.2, an open model deployed on its own infrastructure. This also ensured that sensitive attack data stayed within Hugging Face's environment.

Hugging Face has since closed the vulnerable code execution paths, rebuilt compromised systems, rotated affected credentials and tokens, and strengthened access controls across its clusters. The company also brought in external digital forensics experts and reported the incident to law enforcement.

Users were advised to refresh their access tokens and review account activity.