Hugging Face hit by AI agent attack, data security warning

Hugging Face, a US AI company, said last week (July 16) it was hit by a cyberattack launched by an autonomous AI agent. The attack accessed some internal datasets and service credentials.

The breach started in data processing: a malicious dataset was uploaded, exploiting two code execution bugs to break into worker nodes. The attacker then got cloud and cluster credentials, moving sideways across multiple internal clusters. The whole attack was run by an AI agent framework, possibly built on a security research AI system.

The agent ran tens of thousands of operations in short-lived sandbox environments and set up command-and-control infrastructure that could move on its own. Hugging Face has fixed the bug and brought in outside security experts to investigate. No public models, datasets, or Spaces services were tampered with, and the software supply chain is safe. Users are advised to change access tokens and check for unusual activity.