Hugging Face, which runs one of the largest platforms for hosting and developing AI models, disclosed details of an attack on part of its production infrastructure. The company said the attacker accessed a limited set of internal data and several service credentials.
Hugging Face found no signs of tampering with public models, datasets, or Spaces applications. A review of container images and published software packages also found no supply chain interference. The company has not yet determined whether customer and partner data were affected, has not disclosed the attacker’s identity, and has not identified the language model used.
How the attack started
The initial entry point was the dataset processing pipeline. A malicious dataset exploited two code-execution paths: a remote loader and command injection via a configuration template.
The attacker executed code on a server that processed the data, then escalated access to an infrastructure node, collected cloud and cluster credentials, and moved across several internal environments. This differed from a typical upload of an infected file: the dataset served as a delivery vehicle for commands into a system designed to automatically analyze and transform incoming content.
Hugging Face closed both code-execution paths, removed the attacker’s presence, rebuilt compromised nodes, and revoked affected keys and tokens. The company also began a broader precautionary rotation of secrets and tightened cluster access policies.
Autonomous agent system executed thousands of actions
Hugging Face described the campaign as an attack run end to end by an autonomous agent system. It carried out many thousands of operations through a network of short‑lived isolated environments.
The command‑and‑control infrastructure was hosted on public services and could migrate between them on its own. This approach makes blocking harder: removing one element does not necessarily stop the entire campaign.
Hugging Face did not claim the attack was entirely human‑free. It remains unknown who set the initial objective, controlled the system, and made key decisions. It is also unclear whether the agents operated through a compromised commercial model or a system with open weights.
Defenders also used AI
The incident was detected by Hugging Face’s anomaly analysis system. It uses language models to pre‑process security logs and separate potential threats from large volumes of routine events. To reconstruct the timeline, the company ran AI agents over the attacker’s full activity log, which contained more than 17,000 entries.
The agents correlated events, highlighted indicators of compromise, identified affected credentials, and separated real actions from false trails. According to Hugging Face, the work took hours instead of several days.
At first, the firm tried advanced models via commercial APIs. The analysis required sending the attacker’s actual commands, exploit texts, and command‑and‑control elements. Provider safety restrictions blocked the requests, and the systems could not distinguish an incident investigation from an attempt to obtain assistance with hacking.
Hugging Face did not name the services that refused to process the requests.
The market is already attempting to address this with restricted access. In June, OpenAI launched the specialized GPT-5.5-Cyber for vetted experts. However, the Hugging Face case shows such access must be arranged in advance: during an active attack, securing exceptions can take too long.
Open‑weights model served as a fallback
After commercial systems declined the requests, Hugging Face moved the investigation to its own infrastructure and used GLM 5.2 from Z.ai. Its parameters are available for local deployment under the MIT license.
This allowed the company to analyze hazardous content without automatic request blocking, while the attack logs and referenced credentials remained within the internal environment.
An open‑source model is not inherently safer than a commercial one. The organization assumes responsibility for infrastructure, access control, updates, and agent oversight. A configuration error can widen the impact of an attack.
Attack surface for AI platforms has expanded
The incident showed that not only models and code require protection. Data, configurations, loaders, agent tools, and automated processing pipelines also pose risks.
Any component capable of interpreting external content or executing commands becomes a potential entry point. Risk is especially high in systems where an agent has access to cloud resources, credentials, and other tools.
As a precaution, Hugging Face recommended clients rotate access tokens and review recent account activity. There is no direct evidence yet of compromise of public models or user datasets, but the final impact assessment is not complete.
In November 2025, Anthropic’s threat analysis team in September discovered and disrupted a first‑of‑its‑kind AI‑conducted cyber‑espionage campaign. Experts said the operation was likely planned by a Chinese state entity.
The attacks affected about 30 organizations, including major technology companies, chemical industry enterprises, and government agencies.
In June 2026, Anthropic recommended applying zero‑trust principles to agents: grant minimal privileges, use short‑lived tokens, validate every action, and assume possible compromise.
Back in late 2024, Hugging Face CEO Clément Delangue expressed concern about the rapid development of Chinese AI models and their censorability. He warned of unforeseen consequences for Western companies that chose high‑performance open‑source AI from Chinese developers for integration into their products.
