Hugging Face, an online platform that hosts AI models, has suffered a breach that apparently came from an autonomous AI program.
The New York-based company detected the intrusion last week after noticing “a swarm of tens of thousands of automated actions” in Hugging Face’s internal systems, it wrote in a report.
The breach exploited how users can upload data to Hugging Face, which hosts over 2 million public AI models, including those from top providers such as OpenAI. Specifically, the attack uploaded a malicious dataset that exploited “two code-execution paths” in Hugging Face’s data processing pipeline to run rogue code. “From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend,” the company said.
As a result, the attack was able to breach “a limited set of internal datasets and...several credentials used by our services.” In response, Hugging Face moved to plug the root vulnerability and boot out the attacker, including revoking login credentials and tokens.
Although Hugging Face is still investigating the incident, the company says: “We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.” However, Hugging Face is still determining whether any customer or partner data was affected. At the end of 2025, the platform grew to 13 million users.
In the meantime, the breach stands out because Hugging Face suspects “an autonomous AI agent system” orchestrated the entire intrusion. The company notes the attacker executed “many thousands of individual actions across a swarm of short-lived sandboxes."
It's unclear how the malicious AI agent was built. But Hugging Face suspects the hacker used an AI program focused on cybersecurity research, which would explain the malicious program’s ability to quickly identify a software flaw and exploit it. “Autonomous, AI-driven offensive tooling is no longer theoretical. It lowers the cost of running a broad, patient, multi-stage campaign, and it operates at machine speed,” the company added.
The breach highlights the growing menace of AI-assisted hacks. In November, Anthropic uncovered evidence that Chinese state-sponsored hackers used its AI coding tool to automate the attempted hacking of 30 global targets.
Matching the Adversary's Speed #
In Hugging Face’s case, the company fought fire with fire by initially detecting the intrusion through its own AI tool. “Our anomaly-detection pipeline uses LLM [large language model]-based triage over security telemetry to separate real signals from the daily noise, and it was the correlation of those signals that flagged the compromise,” the company said.
Hugging Face then used a Chinese-developed open-weight AI model, GLM 5.2, to analyze the attack, which spanned over 17,000 recorded events. “Thanks to this approach, we were able to do in hours what would usually take days, and match the adversary's speed,” it added.
To fend off future hacks and bolster security, the IT industry has started to use cutting-edge AI models, including Anthropic's Mythos, to help identify and patch software bugs at a potentially faster rate. Hugging Face said using AI will help it keep pace against cybersecurity threats.
Still, the company noted it first tried using a leading-edge “frontier” AI model from the top providers to analyze the attack. But ironically, the providers rejected the request, since “these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker,” it said.
“The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment,” Hugging Face added.