AI platform Hugging Face has disclosed a security incident where an attacker used an autonomous AI agent to breach parts of its internal systems last week. The attack began by exploiting vulnerabilities in the company's data-processing pipeline, allowing the threat actor to gain deeper access to internal infrastructure.
According to the company, the attacker stole internal datasets and several cloud service credentials. However, Hugging Face said it found no evidence that customer data, public AI models, datasets, Spaces, or its software supply chain were affected.
The intrusion started when a malicious dataset exploited two code-execution flaws in the platform's dataset processing system. The attacker then gained node-level access, escalated privileges, collected cloud credentials, and moved across several internal clusters.
Hugging Face said the attack was carried out by an autonomous AI agent framework that performed thousands of actions across short-lived sandboxes.
“The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. This matches the "agentic attacker" scenario the industry has been forecasting,” the company noted in its incident report.
The company also said that it attempted to use a frontier AI model to investigate the breach, but the model's safety guardrails blocked the analysis because it could not distinguish between an incident response investigation and offensive hacking activity.
“We do not know which model powered the attacker's agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried,” the company explained.
In response, Hugging Face addressed the weaknesses exploited in the attack, removed the attacker's access, rebuilt affected systems, rotated compromised credentials, and strengthened cluster security controls.