- Published on
World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent
- Authors
- Name
- DeepHorus
In an ironic twist, open-source artificial intelligence platform Hugging Face revealed that it was breached by an autonomous AI agent system. The company detected and responded to the incident targeting its production infrastructure earlier last week, marking one of the first known cyberattacks executed by an AI agent in the wild. This attack highlights emerging security challenges as AI models become both tools and threats in cybersecurity.
Hugging Face, a leading repository for AI models and datasets, disclosed that unauthorized access was gained to a limited set of internal datasets and several service credentials. The investigation remains ongoing, but the company found no evidence that public user-facing models, datasets, or Spaces were tampered with, nor its software supply chain compromised. The attack's starting point was the data processing pipeline itself, exploiting a malicious dataset.
The attacker abused two code execution paths: the remote code dataset loader and a template injection in a dataset configuration to run code on a processing worker. From there, the threat actor escalated to node-level access, collected cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. The exact large language model used is unclear, but the campaign was executed by an autonomous agent framework performing thousands of individual actions across short-lived sandboxes with self-migrating command-and-control staged on public services.
Hugging Face has since addressed the root cause, precisely the code execution pathways used for initial access. Remediation steps included removing the attacker's foothold across affected clusters, rebuilding compromised nodes, revoking and rotating affected credentials and tokens, and undertaking a broader secret rotation as a precaution. Additional guardrails and stricter admission controls were deployed on clusters, and detection and alerting were improved to ensure 24/7 response within minutes.
The company urged customers to rotate any access tokens and review recent account activity. In a notable twist, Hugging Face turned to Z.ai's GLM 5.2, a Chinese open-weight model, for forensic analysis after Western frontier models refused requests containing real attack commands, exploit payloads, and C2 artifacts. The safety guardrails of Western models blocked analysis because they could not differentiate between an attacker and legitimate incident response.
"This experience points to a gap worth planning for," the New York-headquartered company said. "We do not know which model powered the attacker's agents... either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried." The practical lesson for defenders is to have a capable model vetted and ready on their own infrastructure before an incident, both to avoid guardrail lockout and to keep attacker data from leaving the environment.
Looking ahead, this incident underscores the need for organizations to prepare for AI-enabled attacks and ensure their defensive tools are unrestricted. As AI agents become more sophisticated, security teams must adapt by using open-weight models that can handle malicious artifacts during investigations. Hugging Face's proactive remediation and transparency set a precedent for the industry, but the broader implications for supply chain security and AI governance remain significant.
