An AI agent broke into Hugging Face and stole credentials from the inside

Key points

• Hugging Face disclosed on Thursday that attackers broke into its production systems using an autonomous AI agent, a program that acts on its own without a human at the keyboard.
• The attackers planted a booby-trapped dataset that exploited two code-execution flaws in Hugging Face's data-processing pipeline.
• Hugging Face hosts more than 45,000 AI models and is used by over 50,000 organisations, according to the company.
• The company says its public models, datasets and Spaces show no sign of tampering, and its software supply chain has been "verified clean."
• Users are being told to rotate their access tokens and check recent account activity.

Hugging Face, the popular online library where developers share artificial intelligence models, says attackers broke into its internal systems and stole credentials. The unusual part: the break-in was run by an AI agent, a piece of software that decides its own next move.

The company explained the incident in a disclosure published Thursday, first reported by BleepingComputer.

Think of Hugging Face as the GitHub of AI. It hosts more than 45,000 machine-learning models from major AI providers, and more than 50,000 organisations use it.

The attackers targeted a specific corner of that platform: the pipeline that processes datasets uploaded by users.

How did the attackers actually get in?

They uploaded a malicious dataset designed to exploit two flaws in Hugging Face's own code that let files run commands on the server. One was a template injection, where hidden instructions inside a configuration file get executed as code. The other was a remote code loader, meaning a dataset that could pull in and run outside code when opened.

Once that code ran on a processing worker, a background machine that unpacks and prepares datasets, the attackers grabbed cloud and cluster credentials. Those are the digital keys that let software talk to the rest of a company's infrastructure. With the keys, they moved sideways into other internal clusters.

This is where the story gets unusual.

Hugging Face says the whole campaign was run by "an autonomous agent framework" that carried out "many thousands of individual actions across a swarm of short-lived sandboxes." In plain English: an AI program, not a human, was making decisions and firing off commands at machine speed. Its control server kept hopping between free public services to hide.

The company said this fits "the 'agentic attacker' scenario the industry has been forecasting." It does not yet know which AI model powered the agent, whether a jailbroken commercial one or an unrestricted open model anyone can download.

There is a wry detail in the disclosure. Hugging Face's own investigators tried to use hosted AI models to analyse the attack and got blocked by those models' safety filters. The attacker's AI, of course, had no such rules.

What has Hugging Face done about it?

The company says it has closed the two vulnerable code paths, kicked the attacker out, rebuilt the affected servers, and rotated every credential that was exposed. It has brought in outside forensic experts and notified law enforcement.

Hugging Face is still checking whether any partner or customer data was taken. If it was, the company says it will contact those affected directly. So far, it has found no evidence that public models, datasets or Spaces (the interactive demos users host on the site) were altered.

What should ordinary users do?

If you have a Hugging Face account, rotate your access tokens. That means going into your account settings, deleting the old keys your apps use to log in, and generating new ones. Also review recent activity for anything you do not recognise.

Multi-factor authentication would not have stopped this specific attack, because the attackers stole machine-to-machine credentials, not user passwords. But turning it on still protects your account from unrelated phishing attempts.

This is the first Hugging Face breach publicly tied to an AI agent, but not the first breach overall. Two years ago the company revoked authentication secrets after intruders got into its Spaces platform. Criminals have also repeatedly abused the site to spread malicious models and Android malware.