Hugging Face Breached by Autonomous AI Agent via Malicious Dataset

The world's largest AI model repository, Hugging Face, was breached by an autonomous AI agent that abused a malicious dataset to reach production infrastructure. The open-source AI platform said it detected and contained the incident targeting production systems earlier last week, after unauthorized access to a limited set of internal datasets and several service credentials.

Investigators found no evidence that the AI agent tampered with public, user-facing models, datasets, or Spaces, or with Hugging Face's own software supply chain. The intrusion began in the data processing pipeline: a malicious dataset exploited two code-execution paths—the remote-code dataset loader and a template injection in dataset configuration—to run code on a processing worker. From there, the attacker escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.

The exact large language model behind the campaign remains unclear. Hugging Face described an autonomous agent framework that performed many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. The company has closed the code-execution pathways used for initial access and completed remediation: removing the foothold and rebuilding compromised nodes, rotating affected credentials and secrets more broadly, adding cluster guardrails and admission controls, and improving 24×7 detection so responders are notified within minutes. Customers are urged to rotate access tokens and review recent account activity.

Forensics also highlighted a defensive blind spot. Western frontier models refused requests that included real attack commands, exploit payloads, and C2 artifacts because safety guardrails could not tell attacker traffic from legitimate incident response. Hugging Face turned to Z.ai's open-weight GLM 5.2 for analysis and advises defenders to keep a capable on-prem model ready before an incident—to avoid guardrail lockout and keep attacker data inside their environment. Read more: The Hacker News report on the Hugging Face breach.