An AI Bot Broke Into Hugging Face. Hugging Face Used AI to Figure Out What It Did.
The machine learning platform says an automated attack ran tens of thousands of actions inside its systems before being caught. Here is what got in, what was taken, and what ordinary users need to know.
Key points
- Hugging Face, a platform used by researchers and companies to share AI models, confirmed a data breach caused by an attack run almost entirely by automated software.
- The attackers got in through a booby-trapped dataset, a collection of training data, that triggered two separate code-execution flaws in Hugging Face's processing pipeline.
- Hugging Face's own systems logged more than 17,000 events tied to the intrusion before the company evicted the attackers and rebuilt the affected servers.
- Internal datasets and service credentials, which are passwords or keys used by software to access other services, were accessed without authorisation.
- Hugging Face says it found no evidence that public-facing AI models, datasets, or published software packages were tampered with.
Hugging Face builds and runs one of the most widely used platforms for sharing AI models and datasets. Think of it as a GitHub for machine learning. Last week the company disclosed that criminals broke into its production infrastructure using an attack piloted almost entirely by an AI agent, software designed to carry out complex tasks on its own without a human steering every step.
The entry point was a poisoned dataset. When Hugging Face's pipeline went to process the file, it triggered two flaws the company had not patched. One was a remote-code loader, meaning the dataset could instruct the server to fetch and run outside code. The second was a template-injection vulnerability, a flaw where specially crafted text tricks a system into executing commands it should only be reading. Together, the two weaknesses let the attackers run their own code on Hugging Face's processing workers.
From there the attack escalated quickly.
The criminals harvested stored credentials and moved sideways through the network, a technique called lateral movement where an attacker uses one foothold to reach further systems. The whole operation ran through an autonomous framework built on top of a security-research harness, spinning up thousands of short-lived sandboxes, which are isolated temporary computing environments, and using public internet services to relay instructions back to the attackers. Hugging Face counted more than 17,000 logged events before the intrusion was fully contained.
Should users of Hugging Face be worried?
For most people who use the platform to download models or datasets, the current evidence is reassuring. Hugging Face says it verified that public models, public datasets, the Spaces app-hosting product, container images, and published packages were all clean. No tampering was found.
That said, any service credentials that existed at the time of the breach should be treated as potentially exposed. If you have API tokens, which are long passwords that let software connect to Hugging Face on your behalf, rotating them now is a sensible precaution. Hugging Face says it has already revoked and replaced the credentials it controlled.
MFA, meaning multi-factor authentication where you confirm your identity through a second step such as an app or a text message, would not have stopped this particular attack. The criminals got in through a software flaw, not a stolen password. What would have helped: sandboxing the dataset processing pipeline more strictly from the start, and catching the anomalous outbound connections earlier.
Hugging Face reported the breach to law enforcement and brought in outside forensic specialists. The company used its own AI tools to reconstruct the attack timeline, which is worth noting: both the attack and much of the investigation ran on machine intelligence. The criminals' specific AI model was never identified.
