Hugging Face, a prominent open-source platform recognized as a key player in the machine learning community, has reported an incident involving unauthorized access to portions of its production infrastructure. The company attributes this breach to an automated AI agent that managed the operation independently from beginning to end.
During the attack, a restricted amount of internal data and various credentials linked to Hugging Face services were compromised. The organization is currently assessing whether client or partner data has been affected and has committed to informing the relevant parties should the investigation yield concerning results.
According to the company’s security incident statement, investigators found no indication that public models, datasets, or Spaces were altered. Furthermore, Hugging Face confirmed that its publicly available packages and container images remain unaffected.
Malicious Dataset Exploited Internal Vulnerabilities
The breach was initiated through a malicious dataset that exploited two distinct code execution pathways within Hugging Face’s dataset-processing architecture. These vulnerabilities included a remote code execution tactic via a dataset loader and an injection technique utilizing a dataset configuration template.
Once the attacker gained code execution on a processing worker, they achieved node-level access and harvested cloud and cluster credentials. These credentials facilitated unauthorized movement through several internal clusters over the course of a weekend.
Hugging Face noted that this incident is distinct from prior breaches in that it was fully managed by an autonomous agent framework. This system executed thousands of actions within temporary sandboxes and employed public services to establish a self-sustaining command-and-control structure.
Researchers speculate that this framework may have originated from an agent-based security research tool, yet the specific language model orchestrating it remains unidentified. The company was also unable to ascertain whether a jailbroken commercial model or an unrestricted open-weight model was utilized by the attacker.
AI Utilized to Analyze the Breach
In response to the incident, Hugging Face revoked the attacker’s access, restored impacted nodes, and canceled any exposed credentials and tokens. Additionally, the company initiated a rotation of other security credentials as a preventive measure and tightened access controls for its internal clusters.
Investigators leveraged language models to scrutinize over 17,000 recorded events. This analysis reconstructed the timeline of the attack, identified potential indicators of compromise, mapped accessed credentials, and distinguished genuine activities from decoys in a matter of hours, significantly expediting typical incident response times.
However, the investigation faced challenges due to commercial AI model APIs that blocked requests involving exploit commands, malicious payloads, and artifacts related to command-and-control operations, despite Hugging Face submitting such materials for forensic review.
To navigate this obstacle, Nestled within its own infrastructure, Hugging Face deployed GLM 5.2, an open-weight model, allowing investigators to analyze the complete event log while ensuring sensitive data remained securely contained within their systems.
No Evidence of Tampering Found in Public Models
Rohit Valia, CEO of cybersecurity firm Tumeryk, advised that organizations utilizing open-source model repositories should look beyond standard code scanning practices. He advocated for evaluating models for behavioral drift, as well as verifying their origins and integrity, particularly in contexts involving training or fine-tuning.
Valia also highlighted the utility of AI trust scores and risk assessment frameworks, such as the Cloud Security Alliance’s RiskRubric v2, for systematic model testing. Despite this, Hugging Face’s investigation yielded no evidence indicating that its public models or datasets were tampered with during the breach.
Recommendations for Hugging Face Users
For users of Hugging Face, the company suggests rotating access tokens and reviewing account activity for any unfamiliar transactions. Reports of suspicious activity can be directed to the designated security email.
The investigation is ongoing, with support from external forensic experts, and Hugging Face has submitted a report to law enforcement. As of now, the identity of the attacker remains unknown, and the extent of the compromised credentials and datasets is yet to be fully determined.