Hugging Face Confirms AI Agent Breached Production Systems

Hugging Face said an autonomous AI agent carried out a cyberattack against its production infrastructure, according to TechRepublic. The company confirmed that the attacker exploited weaknesses in its data processing pipeline, leading to unauthorized access to some internal datasets and service credentials. No public models, user data, or published software were affected, and the company has advised users to rotate tokens and review account activity.

The breach began when a malicious dataset triggered code execution paths in Hugging Face’s dataset loader and configuration system, as detailed by Hyper.ai. The attacker, operating through a distributed AI agent framework, executed thousands of automated actions, escalated privileges, and moved laterally across internal clusters.

Hugging Face’s internal AI supported security tools detected the intrusion and analyzed more than 17,000 attacker logs to reconstruct the timeline and verify the scope of compromise. Investigators relied on the GLM 5.2 model hosted privately to avoid safety restrictions in commercial models that interfered with forensic analysis.

The company has since closed exploited paths, rebuilt affected systems, tightened cluster security, and involved external forensic specialists and law enforcement. The investigation remains active.