Hugging Face’s infrastructure was attacked by an autonomous system of AI agents

A system of autonomous AI agents was able to dive into Hugging Face’s production infrastructure. During the incident, the attackers gained access to a limited amount of internal data and a number of official credentials. At the moment, the company is conducting a detailed investigation to find out whether the confidential information of customers or partners of the platform has been touched.

Attack mechanism and exploitation of vulnerabilities

The attack began with the introduction of a malicious dataset that exploited two specific vulnerabilities in the data processing system. After successfully executing the code on the production server, the attacker elevated his privileges, which allowed him to steal credentials for cloud and cluster services. During the weekend, the agent program moved between internal clusters.

Features of using agents

According to the Hugging Face report, the agent system offline performed thousands of actions in short-lived isolated environments, constantly transferring its own management infrastructure between public services. At this time, the specific language model behind this attack remains unknown.

Incident investigation and the role of the Chinese AI model

To conduct an internal audit, Hugging Face used its own systems of AI agents, analyzing more than 17,000 suspicious actions. Interestingly, the commercial models that were initially accessed through the API blocked the requests because they contained real attack commands, exploits, and malicious infrastructure elements. As a result, specialists used the GLM-5.2 model from the Chinese company Z.ai, deploying it locally. This made it possible to study the materials of the attack without risking the data security of third-party services.

Implications and recommendations for users

Hugging Face reported that it has not detected any interference with public datasets, Spaces, or predicted models. However, the company has already closed the identified vulnerabilities, rebuilt the compromised nodes and forcibly updated the credentials. Platform users are strongly encouraged to update their access tokens and review their account activity history for anomalies.