Hugging Face has disclosed a security incident involving unauthorized access to certain parts of its production infrastructure, affecting a limited set of internal datasets and several service credentials.
The AI platform made this disclosure on July 16, 2026, noting that it is still investigating whether any partner or customer data was compromised.
The company stated that it will inform affected parties directly if necessary. Fortunately, Hugging Face found no evidence that public models, user-facing datasets, or Spaces were altered. It confirmed that its software supply chain, including container images and published packages, was verified as clean.
Hugging Face Security Breach
The intrusion reportedly originated in Hugging Face’s dataset-processing environment, which handles untrusted content and therefore poses a high risk for AI platforms.
According to the company, a malicious dataset exploited two distinct code-execution vulnerabilities: a remote-code dataset loader and a template-injection flaw in a dataset configuration.
These combined weaknesses allowed the execution of attacker-controlled code on a processing worker. The threat actor was then able to escalate privileges, gain node-level access, harvest cloud and cluster credentials, and move laterally across several internal clusters during a weekend operation.
Hugging Face characterized the campaign as an autonomous, AI-driven intrusion. The actor allegedly utilized an agent framework similar to a security-research harness to conduct thousands of actions from a swarm of short-lived sandboxes.
Their command-and-control infrastructure was self-migrating and staged through public services, complicating tracking and prevention efforts.
This incident illustrates how autonomous tools can reduce the operational costs of multi-stage attacks, enabling adversaries to conduct reconnaissance, steal credentials, escalate privileges, and move laterally at machine speed.
The company reported that its AI-assisted anomaly-detection pipeline initially identified the intrusion by correlating suspicious signals across security telemetry.
Investigators then employed large language model (LLM) driven analysis agents to process over 17,000 attacker events, reconstruct the timeline, identify indicators of compromise, map potentially accessed credentials, and distinguish between genuine activity and decoy actions. Hugging Face indicated that this automated analysis reduced what could ordinarily be a multi-day process to just hours.
However, the company’s initial plan to analyze the incident using commercial frontier-model APIs faced an unexpected challenge. Hosted models blocked requests that contained real attack commands, exploit payloads, and command-and-control artifacts due to their safety policies.
As a result, Hugging Face conducted its forensic review internally using GLM 5.2, an open-weight model deployed on its own infrastructure. This method also ensured that potentially sensitive attacker data and exposed credentials did not leave the company’s environment.
In response to the incident, Hugging Face closed the vulnerable dataset execution paths, removed the attacker’s foothold, rebuilt compromised nodes, and revoked or rotated affected credentials and tokens.
The company also initiated broader precautionary secret rotations, introduced stricter cluster admission controls, expanded security guardrails, and improved alerting to ensure high-severity events are responded to within minutes. External forensic specialists and law enforcement agencies are involved in the ongoing investigation.
Hugging Face recommends that users rotate their access tokens and review recent account activity. This incident underscores a growing security concern for AI providers: datasets, loaders, templates, and model-processing pipelines must be regarded as critical attack surfaces, particularly as agentic systems make large-scale offensive operations increasingly feasible.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
