Hugging Face says autonomous AI agents drove intrusion into production systems

The company says the attack began in its dataset-processing pipeline, accessed internal datasets and service credentials, and prompted a broad rotation of secrets.

Hugging Face says it detected and contained an intrusion into part of its production infrastructure that was operated end to end by an autonomous AI agent system, marking a security incident the company says began through its dataset-processing pipeline.

The company identified unauthorized access to a limited set of internal datasets and several credentials used by its services. It said it had found no evidence that public user-facing models, datasets or Spaces were tampered with, and that its software supply chain, including container images and published packages, was verified clean.

Hugging Face is still assessing whether partner or customer data was affected. It said it will contact affected parties directly where required.

The initial access came from a malicious dataset that abused two code-execution paths in dataset processing, Hugging Face said. One involved a remote-code dataset loader; the other used template injection in a dataset configuration. The attack ran code on a processing worker, then escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters during a weekend.

The company characterized the campaign as an autonomous agent framework that took many thousands of actions through a swarm of short-lived sandboxes. It also said the attackers used self-migrating command-and-control infrastructure staged on public services.

Hugging Face did not identify the underlying large language model, disclose parameter counts, name the attacker, or provide an independent technical attribution. Its description says the framework appeared to be built on an agentic security-research harness, but the company said the LLM used remains unknown.

In response, Hugging Face said it closed the dataset code-execution paths used for initial access, rebuilt compromised nodes, removed the attacker’s foothold from affected clusters, and revoked and rotated affected credentials and tokens. It has also started a broader precautionary rotation of secrets.

The company said it added cluster guardrails and stricter admission controls, and changed its detection and alerting process so high-severity signals page a responder within minutes at any time of day. It is working with outside cybersecurity forensic specialists and has reported the incident to law enforcement agencies.

For users, the immediate recommendation is straightforward: rotate Hugging Face access tokens and review recent account activity. Even though the company says the compromised credentials were revoked and rotated, user-controlled tokens can remain valuable targets in incidents involving internal access and processing infrastructure.

The incident puts particular pressure on AI platforms that execute or transform user-provided data. Dataset loaders, templates and preprocessing workers are often treated as operational tooling rather than exposed application surfaces. Hugging Face’s account shows that code execution in those paths can bridge from untrusted content into cluster credentials and internal services unless execution is tightly isolated.

Uncertainty remains substantial. Hugging Face has not said whether customer or partner data was accessed, how long the attackers retained access, which clusters were affected, or whether the autonomous system independently chose each action or followed prebuilt objectives. The company also has not published benchmarks, compute costs, model details or forensic artifacts that would allow outside researchers to assess the claimed degree of agent autonomy.

Still, the operational lesson does not depend on settling those attribution questions. Systems that process untrusted datasets need the same defenses expected of internet-facing workloads: minimized credentials, strong workload isolation, restricted network paths, short-lived secrets, admission controls and alerts that reach human responders quickly.