UPDATE 7/21: The Hugging Face breach has been traced to several AI models breaking out of containment at OpenAI and using a zero-day vulnerability to access the open internet.
Original Story 7/20:
Hugging Face, an online platform that hosts AI models, has suffered a breach that apparently came from an autonomous AI program.
The New York-based company detected the intrusion last week after noticing “a swarm of tens of thousands of automated actions” in Hugging Face’s internal systems, it wrote in a report.
The breach exploited how users can upload data to Hugging Face, which hosts over 2 million public AI models, including those from top providers such as OpenAI. Specifically, the attack uploaded a malicious dataset that exploited “two code-execution paths” in Hugging Face’s data processing pipeline to run rogue code. “From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend,” the company said.
As a result, the attack was able to breach “a limited set of internal datasets and…several credentials used by our services.” In response, Hugging Face moved to plug the root vulnerability and boot out the attacker, including revoking login credentials and tokens.
Although Hugging Face is still investigating the incident, the company says: “We have found no evidence of tampering with public, user-facing models, datasets, or Spaces, and our software supply chain (container images and published packages) was verified clean.” However, Hugging Face is still determining whether any customer or partner data was affected. At the end of 2025, the platform grew to 13 million users.
(Credit: huggingface.co)
In the meantime, the breach stands out because Hugging Face suspects “an autonomous AI agent system” orchestrated the entire intrusion. The company notes the attacker executed “many thousands of individual actions across a swarm of short-lived sandboxes.”
It’s unclear how the malicious AI agent was built. But Hugging Face suspects the hacker used an AI program focused on cybersecurity research, which would explain the malicious program’s ability to quickly identify a software flaw and exploit it. “Autonomous, AI-driven offensive tooling is no longer theoretical. It lowers the cost of running a broad, patient, multi-stage campaign, and it operates at machine speed,” the company added.
The breach highlights the growing menace of AI-assisted hacks. In November, Anthropic uncovered evidence that Chinese state-sponsored hackers used its AI coding tool to automate the attempted hacking of 30 global targets.
Matching the Adversary’s Speed
In Hugging Face’s case, the company fought fire with fire by initially detecting the intrusion through its own AI tool. “Our anomaly-detection pipeline uses LLM [large language model]-based triage over security telemetry to separate real signals from the daily noise, and it was the correlation of those signals that flagged the compromise,” the company said.
Recommended by Our Editors
Hugging Face then used a Chinese-developed open-weight AI model, GLM 5.2, to analyze the attack, which spanned over 17,000 recorded events. “Thanks to this approach, we were able to do in hours what would usually take days, and match the adversary’s speed,” it added.
To fend off future hacks and bolster security, the IT industry has started to use cutting-edge AI models, including Anthropic’s Mythos, to help identify and patch software bugs at a potentially faster rate. Hugging Face said using AI will help it keep pace against cybersecurity threats.
Still, the company noted it first tried using a leading-edge “frontier” AI model from the top providers to analyze the attack. But ironically, the providers rejected the request, since “these requests were blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker,” it said.
“The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment,” Hugging Face added.
About Our Expert
Michael Kan
Principal Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Click Here For The Original Source.
