Crypto news

The major platform for hosting and developing AI models, Hugging Face, has disclosed details of an incident that marks a qualitatively new stage in the evolution of cyberattacks. Using an autonomous agent system, an attacker gained access to part of the company's internal infrastructure, including a limited set of data and service credentials.

It is important to emphasize: the attack did not affect public models, datasets, or Spaces applications. No signs of supply chain compromise through container images or software packages were detected either. However, as is often the case in such situations, the full picture of the consequences is not yet clear — the company is continuing its investigation, and client and partner data may be at risk.

Entry Point: Data Processing Pipeline

The initial breach occurred through the dataset processing pipeline. A malicious dataset used two mechanisms enabling code execution: a remote loader and command injection via a configuration template. This is not simply loading an infected file, but using the processing process itself as an attack vector. By running code on the server, the attacker escalated privileges to an infrastructure node, collected credentials for cloud services and clusters, and then moved into internal environments.

Hugging Face responded promptly by closing both code execution paths, removing the attacker's presence, rebuilding compromised nodes, and revoking affected keys and tokens. The company also initiated a broader preventive rotation of secrets and tightened access rules for clusters.

Autonomous Agent System: Thousands of Operations

The key feature of this attack is its complete automation. Hugging Face describes the campaign as managed from start to finish by an autonomous agent system. It performed thousands of operations through a network of short-lived, isolated environments. The command and control (C2) infrastructure was hosted on public services and could autonomously migrate between them, making blocking extremely difficult: removing one element does not stop the entire campaign.

However, as the company rightly notes, this does not rule out human involvement. It is unknown who set the initial goal, controlled the system, and made key decisions. It is also not established whether the agents operated through a compromised commercial model or an open-weight system.

AI Defense vs. AI Attacks

Ironically, the incident was detected by Hugging Face's anomaly analysis system, which itself uses language models for initial processing of security logs. To reconstruct the timeline, the company launched AI agents over the full log of the attacker's actions, containing over 17,000 entries. The agents correlated events, highlighted indicators of compromise, and identified affected credentials, completing work that would have taken humans days in just a few hours.

An unexpected obstacle arose along the way: an attempt to use advanced commercial models to analyze the attacker's actual commands was blocked by provider safety restrictions. The systems could not distinguish a digital incident investigation from an attempt to get help with hacking.

Open-Weight Model as a Backup Tool

After the commercial systems refused, Hugging Face moved the investigation to its own infrastructure, using the open-source model GLM 5.2 from Z.ai. This allowed analysis of dangerous content without automatic request blocking, and the attack logs and credentials did not leave the internal environment. However, as I have repeatedly noted, an open-source model is not inherently safer than a commercial one. The organization assumes full responsibility for the infrastructure, access management, and agent action control. A configuration error could expand the consequences of an attack.

Expanding the Attack Surface

This incident is a clear signal for the entire industry. It is necessary to protect not only models and software code, but also data, configurations, loaders, agent tools, and automated processing pipelines. Every component capable of interpreting external content or executing commands becomes a potential entry point. The risk is particularly high for systems where the agent has access to cloud resources and credentials.

As a precautionary measure, Hugging Face recommended that clients rotate access tokens and check recent account activity. There is no direct evidence yet of compromise of public models or user datasets, but the final assessment of the consequences is not complete.

My professional opinion: The attack on Hugging Face is not just another incident. It is a demonstration that the future of cyber warfare has already arrived. Autonomous agents capable of self-learning and adaptation are becoming the new standard of threats. The industry urgently needs to rethink security approaches, implementing Zero Trust principles not only for people but also for machines. And, as this case showed, readiness for such attacks must be proactive, not reactive — including pre-configuring access to investigation tools.