Security incident disclosure — July 2026

Details

Hugging Face disclosed on July 16, 2026 that attackers gained unauthorized access to a limited set of internal datasets and several service credentials. The intrusion was unique in one important way: it was conducted entirely by an autonomous AI agent system, with Hugging Face detecting and analyzing it largely using AI tools of their own. The initial entry point was the dataset processing pipeline. A malicious dataset exploited two separate vulnerabilities: a remote-code execution path in a dataset loader, and a template-injection flaw in dataset configuration parsing. This gave the attacker code execution on a processing worker, from which the agent escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into multiple internal clusters over a weekend. The campaign ran on an autonomous agent framework — apparently built on an agentic security-research harness, with the underlying LLM still unidentified — executing thousands of individual actions across a swarm of short-lived sandboxes. Command-and-control infrastructure self-migrated across public services to evade detection. Hugging Face confirmed no evidence of tampering with public models, datasets, or Spaces, and verified software supply chain artifacts were clean. The company patched the vulnerable code-execution paths, rebuilt compromised nodes, rotated credentials, tightened cluster admission controls, and improved alerting. External forensics specialists are investigating, and the incident has been reported to law enforcement. All users are advised to rotate HuggingFace access tokens immediately.