Hugging Face, the largest repository of artificial intelligence models and datasets, has announced a breach of its internal infrastructure. That alone would not be particularly unusual, except that the entire attack, from the first action to the last, was directed by an autonomous system of AI-powered agents. Moreover, the company detected and analyzed it using its own AI. According to available information, this is the first publicly confirmed case in which an attack on a major artificial intelligence platform was carried out by an autonomous agent without human control.
How the attacker got in
Hugging Face described the incident in a post on its blog. The entry point was precisely where artificial intelligence platforms are most vulnerable: data processing.
The attack began with the upload of a malicious dataset. It exploited two weaknesses in how Hugging Face processes data. The first allowed third-party code to be executed through the dataset loader, while the second involved smuggling commands into the dataset's configuration file. This allowed the attacker to run their own code on one of the processing nodes.
From there, the attacker spread further. They gained node-wide access, collected credentials for cloud and cluster services, and moved into several internal clusters over a single weekend. The company acknowledges that the attacker accessed a limited set of internal datasets and several credentials used by its services.
The attack was carried out by AI agents
The campaign was not controlled by a human, but by an autonomous system of agents. According to Hugging Face, it appears to have been built on a tool originally intended for security research. The company does not yet know which language model powered it.
The agents performed tens of thousands of individual actions across a swarm of short-lived sandboxes, isolated environments that erase their traces afterward. The command-and-control infrastructure also relocated itself and hid on ordinary public services. This is exactly the kind of agent-led attack scenario that security experts have been predicting for years.
The company emphasizes what did not happen. It found no evidence that the attacker accessed publicly available models, datasets, or Spaces environments. The software supply chain, including container images and published packages, passed inspection cleanly. Hugging Face is still investigating whether the attacker gained access to customer or partner data.
AI agents are investigating the attack
The company was alerted to the attack by its own anomaly detection system, which uses a language model to triage security signals. It separates genuine threats from everyday noise, and it was the correlation of several such signals that revealed something was wrong.
Manually determining what a swarm of tens of thousands of automated actions had actually done would have taken days. Hugging Face therefore deployed a set of AI-powered analytical agents on the complete record of the attacker's actions, comprising more than seventeen thousand events. They assembled a timeline, extracted indicators of compromise, mapped the affected credentials, and separated actual damage from false trails intended to confuse investigators. The work was reduced from days to hours.
The safeguards defenders ran into
When the company began analyzing the attack, it first turned to state-of-the-art models available through commercial interfaces. That did not work. The analysis requires providing the model with large quantities of real attack commands, malicious code, and other traces of the attack. Providers' safeguards blocked precisely these requests because they cannot distinguish a defender investigating a breach of their own systems from an attacker.
Hugging Face therefore moved the investigation to GLM 5.2, a Chinese open-weight model that it ran on its own servers. This gave it one advantage. No data about the attack or the credentials referenced in it left its environment.
The company draws a clear lesson for defenders from this: have a pre-vetted, ready-to-use model that you can run on your own infrastructure before an attack occurs. This is both to avoid running into blocked safeguards and to ensure that sensitive data remains in-house.
This experience fits into the ongoing tension over how strictly models should be safeguarded. Security researchers have long complained that models such as Anthropic's Mythos and Fable are so tightly constrained that they impede even legitimate defense and investigation. The US government has also imposed export restrictions on Fable, forcing Anthropic to temporarily withdraw the model from public use. Fable 5 is now available with additional safeguards, but access to the less restricted Mythos 5 model remains limited to a select few companies.
What the company recommends to users
Hugging Face fixed both data-processing vulnerabilities through which the attacker gained access. It cleaned the affected clusters, rebuilt the compromised nodes, and invalidated and replaced the affected credentials and tokens. As a precaution, it also began rotating other secret keys. In addition, it introduced stricter controls over what can enter the clusters and accelerated alerting so that a serious alarm will rouse the responsible person within minutes, any day of the week.
The company brought in external forensic specialists to assist with the investigation and reported the incident to law enforcement. It advises users to rotate their access tokens as a precaution and review recent activity on their accounts.
Many questions remain unanswered. Hugging Face has not provided evidence to support its claim that a system of agents was behind the attack, and it is unclear whether the company had the security of its systems assessed before launching them. It is also unknown which model powered the attackers, and the company has not yet attributed the attack to anyone. Meanwhile, according to Axios sources, the US government is considering a ban on open-weight models—the exact type of tool that saved Hugging Face during the investigation.
Sources: thehackernews.com, techcrunch.com and gizmodo.com
