Hugging Face Says Autonomous AI System Executed Multi-Stage Cyberattack

According to Hugging Face's security disclosure, the attack began with a malicious dataset that exploited two code execution paths in its dataset processing system. The attackers then escalated privileges, collected cloud and cluster credentials, and laterally moved to multiple internal clusters over a weekend.

Hugging Face stated that the activity was executed by a fully autonomous AI agent framework, which performed thousands of operations in short-lived compute environments while dynamically switching its command-and-control (C2) infrastructure across multiple public services. The company said this behavior aligns with the long-discussed 'agentic attacker' scenario, where AI systems can independently execute complex multi-stage cyber operations at machine speed.

Hugging Face's AI-assisted security system first detected anomalous activity by analyzing suspicious patterns in security telemetry data. Subsequently, the company used AI-driven analysis to examine over 17,000 attacker events, enabling investigators to reconstruct the attack timeline, identify compromised credentials, and distinguish real damage from misleading activity.

Notably, commercial AI models were difficult to use early in the investigation due to safety guardrails that blocked analysis involving real attack commands and exploit data. Investigators ultimately completed the work using the open-source GLM 5.2 model running on Hugging Face's own infrastructure.

After the incident, Hugging Face shut down the vulnerable code execution paths, rebuilt affected systems, revoked compromised credentials, strengthened cluster security controls, and enhanced detection and alerting systems. The company also stated it is working with external cybersecurity forensic experts and has reported the incident to law enforcement. As a precaution, Hugging Face recommends users rotate access tokens and review recent account activity.

The company is still investigating whether any customer or partner information was affected and will notify relevant parties directly if necessary. So far, no evidence has been found of tampering with public models, datasets, Spaces, container images, or published software packages.

This incident highlights the rapidly emerging dual role of AI in cybersecurity as both an offensive and defensive tool. While security researchers have previously warned that autonomous AI agents could eventually automate complex attacks, Hugging Face stated that this event proves such attacks are no longer hypothetical.

For organizations building or deploying AI systems, this breach demonstrates that data pipelines—not just AI models themselves—have become critical security targets. Additionally, the incident underscores the need for AI tools that can run privately during incident response, especially when commercial AI services' safety guardrails may inadvertently hinder legitimate forensic investigations.