Crypto news

The Hugging Face platform, a key player in the ecosystem of AI model development and hosting, has faced an incident that is reshaping perceptions of modern cyber threats. An attacker, using an autonomous agent system, managed to infiltrate part of the company's operational infrastructure, gaining access to a limited amount of internal data and service accounts.

It is important to emphasize: as of now, there is no evidence that public models, datasets, or Spaces applications have been compromised. Checks of containers and software packages have also not revealed any supply chain interference. However, the identity of the attacker and the language model they used remain unknown, and a full assessment of the damage has not yet been completed.

How the Attack Began: The Data Pipeline as an Entry Point

The initial attack vector was the dataset processing pipeline. A malicious dataset used two mechanisms to execute code: a remote loader and command injection through a configuration template. This allowed the attacker to run code on the server processing the data, after which they escalated privileges to the infrastructure node level, collected cloud service credentials, and moved into several internal environments.

Key point: this is not simply uploading an infected file. The dataset acted as a means of delivering commands to a system designed for automatic content analysis and transformation. Hugging Face promptly closed both code execution paths, removed the attacker's presence, rebuilt the compromised nodes, and revoked the affected keys and tokens.

Autonomous Agents: Thousands of Actions Without Human Intervention

Hugging Face characterized this campaign as an attack fully managed by an autonomous agent system. It performed tens of thousands of operations through a network of short-lived isolated environments. The management infrastructure was hosted on public services and could autonomously migrate between them, significantly complicating blocking: removing one element does not stop the entire campaign.

At the same time, the company does not claim the attack proceeded without human involvement. It is unknown who set the initial goal, controlled the system, and made key decisions. It is also unclear whether the agents operated through a compromised commercial model or an open-weight system. This incident demonstrates that AI-driven attacks are becoming more sophisticated and adaptive.

Defense with AI: Hunting Agents

The irony of fate is that the incident was detected by Hugging Face's anomaly analysis system, which uses language models for initial processing of security logs. To reconstruct the timeline, the company deployed AI agents over the full log of the attacker's actions, containing over 17,000 records. The agents correlated events, highlighted indicators of compromise, and identified affected credentials, reducing investigation time from several days to hours.

However, in the initial phase, the company faced an unexpected obstacle: attempts to use advanced commercial models to analyze the attacker's actual commands were blocked by provider safety restrictions. The systems could not distinguish between incident investigation and an attempt to seek help with hacking. This led to a transition to their own infrastructure and the use of the open-weight model GLM 5.2 from Z.ai, which allowed analysis of dangerous content without blocks.

Expanding the Attack Surface and Lessons for the Industry

This incident clearly demonstrates that the attack surface for AI platforms has significantly expanded. Protection is required not only for models and code, but also for data, configurations, loaders, agent tools, and automated processing pipelines. Every component capable of interpreting external content or executing commands becomes a potential entry point.

My expert opinion: The attack on Hugging Face is a harbinger of a new era of cyber warfare, where AI agents become the primary tool for both attack and defense. The industry urgently needs to rethink security approaches, implementing zero-trust principles not only for humans but also for AI systems themselves. Anthropic's recommendations on minimal rights and short-lived tokens for agents now sound like an urgent necessity, not just theory.