Hugging Face, which operates one of the largest platforms for hosting and developing AI models, has disclosed details of an attack on part of its operational infrastructure. According to the company, an attacker gained access to a limited set of internal data and several service account credentials.
The firm found no evidence of changes to public models, datasets, or Spaces applications. Checks of container images and published software packages also revealed no supply chain interference. However, Hugging Face has not yet determined whether customer and partner data were affected, has not disclosed the attacker's identity, and has not identified the language model they used.
How the Attack Began
The initial entry point was a data processing pipeline. A malicious dataset exploited two mechanisms that allowed code execution: a remote loader and command injection via a configuration template.
As a result, the attacker executed code on the server processing the information. They then escalated their access to the infrastructure node, collected credentials for cloud services and clusters, and moved into several internal environments. This scenario differs from the typical uploading of a malicious file, as the dataset was used as a delivery mechanism for commands to a system designed to automatically analyze and transform incoming content.
Hugging Face closed both code execution pathways, removed the attacker's presence, rebuilt the compromised nodes, and revoked affected keys and tokens. The company also initiated a broader preventive replacement of secrets and strengthened access rules to clusters.
Autonomous Agents Executed Thousands of Actions
Hugging Face described the campaign as an attack entirely managed by an autonomous agent system, which executed thousands of operations through a network of short-lived isolated environments.
The command and control infrastructure was hosted on public services and could autonomously move between them. This approach complicates blocking efforts: removing one element does not necessarily halt the entire campaign.
Hugging Face does not claim that the attack occurred without human involvement. It remains unclear who set the initial target, controlled the system, and made key decisions. It is also unknown whether the agents operated through a compromised commercial model or an open-weight system.
Defenders Also Used AI
The incident highlighted Hugging Face's anomaly detection system, which uses language models for initial processing of security logs, separating potential threats from a large volume of normal events. To reconstruct the timeline, the company deployed AI agents over the complete log of the attacker's actions, which contained over 17,000 entries.
The agents correlated events, identified signs of compromise, determined affected credentials, and separated real actions from false leads. According to Hugging Face, this process took hours instead of several days.
Initially, the firm attempted to use advanced models via commercial APIs. For analysis, they needed to transmit real commands from the attacker, exploit texts, and elements of the command infrastructure. However, protective restrictions from providers blocked the requests, and systems could not distinguish between investigating a digital incident and attempting to seek help with a hack.
Hugging Face did not name the services that refused to process the requests.
The market is already trying to address this issue through limited access. In June, OpenAI launched a specialized GPT-5.5-Cyber for vetted experts. However, the Hugging Face incident shows that such access must be configured in advance: during an active attack, negotiating exceptions can take too long.
Open-Weight Model Became a Backup Tool
After the failures of commercial systems, Hugging Face shifted the investigation to its own infrastructure and utilized GLM 5.2 from Z.ai. Its parameters are available for local deployment under the MIT license.
This allowed the company to analyze dangerous content without automatic blocking of requests. At the same time, the attack logs and the mentioned credentials did not leave the internal environment.
However, the open-source model is not inherently safer than commercial ones. The organization assumes responsibility for infrastructure, access management, updates, and agent activity monitoring. A configuration error could amplify the consequences of an attack.
Attack Surface for AI Platforms Has Expanded
The incident demonstrated that protection is needed not only for models and code. Dangers also arise from data, configurations, loaders, agent tools, and automated processing pipelines.
Every component capable of interpreting external content or executing commands becomes a potential entry point. The risk is particularly high for systems where agents have access to cloud resources, credentials, and other tools.
Hugging Face advised clients as a precaution to replace access tokens and review recent account activity. There is currently no direct evidence of compromise to public models or user datasets, but a final assessment of the consequences is still pending.
In November 2025, the threat analysis team at the startup Anthropic discovered and disrupted the first of its kind AI-driven cyber espionage campaign in September. Experts believe the operation was likely planned by a Chinese state entity.
The attacks affected around 30 organizations, including major tech companies, chemical industry enterprises, and government agencies.
In June 2026, Anthropic recommended applying a zero-trust principle to agents: granting minimal rights, using short-lived tokens, verifying every action, and assuming the possibility of compromise.
It is worth noting that in late 2024, Hugging Face CEO Clément Delangue expressed concern about the rapid development of Chinese AI models and their censorship. He warned of unforeseen consequences for Western companies that chose high-performance open-source AI from Chinese developers for integration into their products.