Hugging Face Says Autonomous AI Agents Drove Infrastructure Breach

Hugging Face has disclosed a production infrastructure breach that it says was carried out from beginning to end by an autonomous AI agent system. The attackers exploited code-execution paths in the company’s dataset-processing pipeline, stole infrastructure credentials, and moved across several internal clusters.

The company also used AI to detect and investigate the intrusion. According to the official Hugging Face security incident disclosure, AI-assisted detection flagged the compromise before LLM-powered forensic agents analyzed more than 17,000 recorded attacker events.

Hugging Face found unauthorized access to a limited set of internal datasets and several credentials used by its services. It found no evidence that attackers modified public models, datasets, Spaces, container images, or published software packages.

How the Hugging Face breach started

The attack began with a malicious dataset submitted to Hugging Face’s data-processing infrastructure. The dataset abused two separate code-execution paths to run unauthorized code on a processing worker.

One path involved a remote-code dataset loader. The other involved template injection in a dataset configuration. Hugging Face did not publish CVE numbers or additional technical exploitation details for either issue.

After gaining code execution, the attacker escalated from the processing worker to node-level access. The autonomous system then harvested cloud and cluster credentials before moving laterally into several internal clusters over one weekend.

Attack stage	Observed activity	Potential impact
Initial access	Malicious dataset abused two code-execution paths	Code execution on a processing worker
Privilege escalation	Attacker gained node-level access	Broader control of the affected host
Credential access	Cloud and cluster credentials were collected	Access to additional infrastructure
Lateral movement	Activity spread into several internal clusters	Expansion beyond the original worker
Command and control	Infrastructure migrated across public services	Greater resilience and reduced visibility

Autonomous agents carried out thousands of actions

Hugging Face said the campaign used an autonomous agent framework that appeared to originate from an agentic security-research harness. The company has not identified the language model that powered the attack.

The framework conducted thousands of actions through a swarm of short-lived sandboxes. It also used self-migrating command-and-control infrastructure staged on public services, making the operation more difficult to follow and disrupt.

This level of autonomy allowed the campaign to continue across multiple stages without requiring a person to issue every command. The system could run tasks, process results, and continue operating across the compromised environment at machine speed.

What data and systems were affected?

Hugging Face confirmed unauthorized access to a limited number of internal datasets and several service credentials. The company continues to assess whether the attackers accessed partner or customer information.

So far, the investigation has found no evidence that the attackers tampered with public-facing content or the company’s software supply chain. This includes:

• Public models hosted on Hugging Face
• Public and user-facing datasets
• Hugging Face Spaces
• Published software packages
• Container images distributed by the company

Hugging Face said it would contact affected partners or customers directly if the continuing investigation confirms that their data was involved.

AI-assisted detection uncovered the intrusion

The company’s anomaly-detection system first surfaced the attack. The system uses LLM-based triage to examine security telemetry and identify combinations of signals that conventional alerts may treat as unrelated noise.

After detecting the intrusion, Hugging Face used analysis agents to examine the complete attacker action log. The log contained more than 17,000 recorded events from the campaign.

The agents reconstructed the attack timeline, extracted indicators of compromise, identified credentials the attacker may have accessed, and separated genuine malicious actions from decoy activity. Hugging Face said this reduced an investigation that would normally take days to a matter of hours.

Commercial AI safety controls blocked forensic analysis

Hugging Face initially attempted to use frontier models accessed through commercial APIs for the forensic review. Those attempts failed because the analysis required the company to submit real attack commands, exploit payloads, and command-and-control artifacts.

The API providers’ safety systems blocked the requests because they could not reliably distinguish defensive incident response from malicious activity. Hugging Face did not identify the commercial models or companies involved.

The security team moved the analysis to GLM-5.2, an open-weight model running on Hugging Face’s own infrastructure. This allowed the investigation to continue without sending attacker data or referenced credentials outside the company’s environment.

The incident exposes a problem for AI-assisted defenders

Safety restrictions serve an important role in limiting the malicious use of hosted AI models. However, security teams may need to process exploit code, malware commands, stolen credentials, and other dangerous content during a legitimate investigation.

If a hosted model blocks this material, defenders can lose access to an important analysis tool during an active incident. Attackers using unrestricted models, modified systems, or stolen accounts may not face the same limitations.

Hugging Face recommends that organizations prepare a capable model that they can run inside their own controlled environment. The company said this approach can prevent policy-related interruptions and keep sensitive forensic data within the organization.

Hugging Face closed the exploited paths

Hugging Face says it removed the attackers’ access and rebuilt the compromised nodes. It also closed the two dataset code-execution paths used to start the attack.

The company listed the following response measures in its updated July 2026 security advisory:

• Closed the dataset-processing vulnerabilities used for initial access
• Removed the attacker’s foothold from affected clusters
• Rebuilt compromised nodes
• Revoked and rotated affected credentials and tokens
• Started a wider precautionary rotation of secrets
• Added stricter admission controls to its clusters
• Improved high-severity detection and responder notification

Hugging Face has hired external forensic specialists to support the investigation. It has also reported the incident to law enforcement agencies.

Users should rotate Hugging Face access tokens

Hugging Face recommends that users rotate their access tokens and review recent account activity as a precaution. Users do not need to wait for confirmation that their individual accounts were affected.

Users and administrators can take the following steps:

1. Revoke existing Hugging Face access tokens.
2. Create replacement tokens with only the required permissions.
3. Review recent account and repository activity.
4. Check automation systems for old embedded tokens.
5. Update applications and workflows with the new credentials.
6. Report suspicious activity to Hugging Face security.

Organizations should also check where Hugging Face tokens appear in environment variables, notebooks, scripts, CI/CD pipelines, secrets managers, and shared development systems.

JADEPUFFER shows similar autonomous attack behavior

The Hugging Face incident follows another documented case of AI-directed offensive activity. Sysdig recently described JADEPUFFER as the first known agentic ransomware operation driven end to end by a large language model.

According to the Sysdig JADEPUFFER investigation, the attacker entered through an exposed Langflow instance affected by CVE-2025-3248. The agent collected credentials, explored internal systems, established persistence, and reached a production database server.

The operation later encrypted 1,342 configuration values, deleted the original data, dropped databases, and created a ransom table. Sysdig found more than 600 distinct payloads and observed the system correcting a failed login attempt within 31 seconds.

AI-driven cyber operations are moving into real attacks

Neither campaign relied entirely on new attack techniques. The Hugging Face breach began with code execution in a data-processing pipeline, while JADEPUFFER exploited a known Langflow vulnerability and weak infrastructure configurations.

The important change concerns speed and coordination. An agent can run reconnaissance, credential searches, lateral movement, persistence, and destructive actions without waiting for a human operator to review every result.

Sysdig’s agentic ransomware report warned that AI agents can automate attacks against old vulnerabilities and neglected internet-facing systems at very low cost.

Governments are also preparing AI-powered defenses

The threat has prompted wider investment in defensive AI. The UK National Cyber Security Centre and the Department for Science, Innovation and Technology are developing Cyber Shield, a proposed national-scale approach to agentic cyber defense.

The initiative aims to use frontier AI to help identify, reduce, and resolve cyber risks. It also recognizes that defenders need safeguards, oversight, reliable evaluation, and access to high-quality security data before they can safely automate sensitive decisions.

For businesses, the immediate priority remains strong infrastructure security. Organizations should isolate data-processing workers, limit service-account permissions, remove unnecessary secrets, monitor lateral movement, and ensure one compromised worker cannot provide access to an entire cluster.

The NCSC Cyber Shield blueprint and Hugging Face’s response point toward the same operational need: defenders must prepare AI-assisted detection and investigation capabilities before an incident begins.

FAQ