Hugging Face, built by Clement Delangue (@ClementDelangue), Julien Chaumond (@julien_c), and Thomas Wolf (@Thom_Wolf), closed two dataset-processing vulnerabilities after an attacker reached several internal clusters and obtained service credentials in mid-July.
Hugging Face disclosed the intrusion in a July 16th incident report. TechCrunch reported on July 20th that Hugging Face was still investigating whether customer or partner data had been stolen.
The breach cuts into the central product wager Delangue, Chaumond, and Wolf have pursued for a decade: making models and datasets easy to publish, inspect, modify, and run. A malicious dataset turned that collaboration surface into an entry point for production infrastructure.
Delangue, Chaumond, and Wolf started Hugging Face in 2016 with a consumer chatbot designed as an AI companion for teenagers. Chaumond later recalled in a Sifted interview that Betaworks invested $200,000 and brought the founders to New York after French investors balked at the idea. Hugging Face changed direction after an open-source implementation of Google's BERT model drew developers to its tools.
That pivot turned Hugging Face into a central distribution point for open AI. Hugging Face said in a March 2026 community report that it had reached 13 million users, more than 2 million public models, and over 500,000 public datasets during 2025. Its homepage currently lists more than 1 million applications. The scale that made the founders' open collaboration strategy work also gives uploaded content a large and sensitive processing surface.
A dataset became executable attack code
According to Hugging Face, the attacker uploaded a malicious dataset that exploited a remote-code dataset and a template-injection flaw in a dataset configuration. The code ran on a processing worker, after which the attacker gained node-level access, harvested cloud and cluster credentials, and moved laterally across several internal clusters over a weekend.
Hugging Face said a "limited set" of internal datasets and "several" service credentials were accessed. Hugging Face has not disclosed the number or identity of the affected datasets, credentials, clusters, customers, or partners. The assessment of customer and partner exposure remains incomplete.
Hugging Face said it found no evidence that public models, datasets, Spaces, published packages, or container images were altered. That distinction matters because compromised service credentials can expose internal resources without proving that public artifacts were poisoned. Users still have to treat credentials stored on Hugging Face as potentially exposed until they rotate them and review recent account activity.
The initial compromise also shows why AI datasets cannot always be handled as passive files. Modern dataset services may execute s, render templates, generate previews, transform records, or invoke other processing tools. Each capability adds code and permissions around material supplied by an outside user. Hugging Face's disclosure says the attacker crossed from that processing layer into infrastructure credentials and internal clusters.
Hugging Face said it closed both code-execution paths, rebuilt compromised nodes, removed the attacker's foothold, rotated affected credentials, tightened cluster admission controls, and changed alerting so high-severity events page a responder within minutes. Hugging Face also brought in outside forensic specialists and reported the intrusion to law enforcement.
Hugging Face attributes the campaign to an AI agent
Hugging Face attributed the campaign to an autonomous agent framework that operated through short-lived sandboxes and command-and-control infrastructure hosted on public services. Hugging Face said its logs contained more than 17,000 attacker actions.
That attribution remains a claim from Hugging Face. TechCrunch reported that Hugging Face had not supplied evidence supporting the autonomous-agent conclusion when asked. Hugging Face has not named the framework, the underlying model, the command-and-control services, or an attacker.
The attacker's use of an agent would fit the workload described by Hugging Face: repeated reconnaissance, credential collection, lateral movement, and migration between temporary environments. The logs alone do not establish which model directed those actions or how much human supervision was involved.
Hugging Face's account of the defense carries a separate lesson. Hugging Face said its anomaly-detection system used model-based triage to identify the compromise, then used analysis agents to reconstruct more than 17,000 logged events. Commercial frontier models initially blocked requests containing real exploit commands and attack artifacts, according to Hugging Face. Hugging Face moved the analysis to GLM 5.2, an open-weight model running on its own infrastructure, keeping logs and referenced credentials inside its environment.
That experience reinforces Hugging Face's stated lesson from the incident: defenders need capable models they can inspect and run under their own controls. During an incident, hosted-model guardrails can determine whether a security responder can process malicious code at all.
The founders face a recurring credential problem
This is Hugging Face's second public credential-related security incident in just over two years. In May 2024, Hugging Face said an intruder had gained unauthorized access to its Spaces platform and may have viewed some stored secrets. Hugging Face revoked affected tokens, moved Spaces secrets to a key-management service, and urged users to replace keys and adopt fine-grained tokens.
The July 2026 intrusion began through a different component, but both incidents reached credentials attached to user-supplied workloads. Hugging Face sells private repositories, audit logs, identity controls, inference services, and hosted compute alongside its public hub. Security around tokens, execution boundaries, and tenant isolation therefore sits inside the paid product, rather than functioning as a back-office concern.
For users, the immediate response is straightforward: rotate Hugging Face access tokens and any third-party credentials stored in datasets, repositories, Spaces, configuration files, or secrets; inspect account and organization audit logs; remove unused tokens; and reduce permissions on replacements. A token that cannot write to repositories or reach production services limits the damage if another processing flaw exposes it.
For Delangue, Chaumond, and Wolf, the harder job is preserving the open publishing model while reducing what uploaded content can execute and reach. Their original BERT release worked because Hugging Face removed friction between research and working code. The breach shows the security cost of that same closeness. Hugging Face's next safeguards will have to keep datasets useful to developers while treating every , template, preview, and processing worker as a boundary an attacker may test.