needhelp
← Back to blog

An AI Agent Hacked Hugging Face Over a Weekend — 17,000 Actions, Zero Humans

by needhelp
AI Security
Hugging Face
Agentic Attack
Cybersecurity

The Breach

On July 16, Hugging Face disclosed something genuinely new: an intrusion into its production infrastructure that was “driven, end to end, by an autonomous AI agent system.”

No human sat at a keyboard. No phishing email was sent. A malicious dataset uploaded to Hugging Face’s own pipeline did the job, and an AI agent took over from there.

Over a weekend, it logged over 17,000 individual actions — escalating privileges, harvesting credentials, and moving laterally across internal clusters. The attacker ran on a swarm of short-lived sandboxes with self-migrating command-and-control staged on public services.

How It Worked

The entry was through Hugging Face’s data-processing pipeline — the conveyor belt that ingests user-uploaded datasets. A malicious dataset exploited two code-execution paths:

  1. A remote-code dataset loader, a feature meant to let datasets specify custom loading logic. Weaponized to run arbitrary code.
  2. A template-injection flaw in dataset configuration handling, giving a second redundant route to code execution on a processing worker.

Once the agent had a foothold, it escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters. All without a human operator.

Hugging Face confirmed no public models, datasets, or Spaces were tampered with. The software supply chain (container images and packages) was verified clean. They are still assessing potential impact on partner and customer data.

Detection Was Also AI

The attack was initially surfaced by Hugging Face’s own LLM-based anomaly-detection pipeline, which triages security telemetry and flags real signals from noise.

To reconstruct what happened, Hugging Face ran LLM-driven analysis agents over the full 17,000-event attacker action log. What would normally take days was done in hours. For the first time, both the offense and the defense were fully automated.

The Asymmetry Problem

Here’s the part that kept me up reading.

Hugging Face’s security team tried to use frontier models behind commercial APIs for forensic analysis. It didn’t work. The safety guardrails on those models blocked the attack payloads, exploit code, and C2 artifacts — exactly the kind of data an incident responder needs to analyze.

They ended up running the forensics on GLM 5.2, an open-weight Chinese model, on their own infrastructure. This had an unintended benefit: no attacker data or credentials left their environment.

The attacker’s model is unknown — could be a jailbroken hosted model or an unrestricted open-weight one. Either way, the attacker was bound by no usage policy, while Hugging Face’s own forensic team was blocked by the very safety systems meant to protect platforms. As their post puts it: “the practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident.”

What This Means

The “agentic attacker” scenario the security industry has been forecasting is no longer theoretical. Autonomous offensive tooling lowers the cost of running multi-stage campaigns and operates at machine speed. Platforms can’t rely on human-in-the-loop defense anymore — the numbers don’t add up when an attacker executes 17,000 actions over a weekend.

Hugging Face has closed the exploited code-execution paths, rebuilt affected nodes, rotated credentials, and deployed stricter admission controls. They reported the incident to law enforcement and are working with external forensics specialists.

But the takeaway is broader. If Hugging Face — a company whose entire business is AI infrastructure — wasn’t hardened against agentic attacks, most organizations aren’t either.

References

Share this page