AI Agent Attack on Hugging Face: A New Frontier of Cyber Threats Revealed
The platform for hosting AI models, Hugging Face, faced an incident that redefines perceptions of modern cyber threats. Using a fully autonomous agent system, an attacker managed to infiltrate the internal infrastructure, gaining access to a limited amount of data and several service accounts. It is important to emphasize: public models, datasets, and Spaces applications remained untouched — the supply chain was not compromised. However, the full picture of the impact on client and partner data is not yet clear, nor is the identity of the attacker or the language model they used.
Entry Point: Dataset as a Weapon
The attack began with a dataset processing pipeline. The malicious dataset contained two mechanisms for code execution — a remote loader and command injection through a configuration template. This is not a standard upload of an infected file: the dataset served as a means of delivering commands to a system that was supposed to automatically analyze the content. The attacker executed code on a server, escalated privileges to an infrastructure node, collected cloud credentials, and moved between internal environments. Hugging Face promptly closed both pathways, rebuilt the compromised nodes, revoked affected keys, and initiated a large-scale secret replacement.
Autonomous Agent: Thousands of Operations Without Rest
The campaign was managed exclusively by an autonomous agent system. It performed thousands of operations through a network of short-lived isolated environments. The command and control infrastructure was hosted on public services, allowing it to migrate independently — removing one element did not stop the campaign. At the same time, Hugging Face does not rule out human involvement at the stage of goal setting and key decision-making. It is unknown whether a compromised commercial model or a system with open weights was used.
AI vs. AI: Defense and Investigation
The incident was detected by Hugging Face's anomaly analysis system, which uses language models for initial processing of security logs. To reconstruct the timeline, the company deployed AI agents over the full log of the attacker's activity, containing over 17,000 entries. The agents correlated events, highlighted indicators of compromise, and identified affected credentials — the work took hours instead of days. However, in the initial phase, commercial systems blocked requests, failing to distinguish the investigation from an intrusion attempt. Hugging Face did not disclose the failing services, but this case underscores the need for pre-configuring specialized access, such as OpenAI's GPT-5.5-Cyber.
Open Weights as a Backup Tool
After the commercial systems failed, Hugging Face moved the investigation to its own infrastructure, using Z.ai's GLM 5.2 with open parameters under the MIT license. This allowed analyzing dangerous content without automatic blocking, without exporting data beyond the internal environment. However, an open-source model is not inherently safer — the organization takes responsibility for the infrastructure, access management, and updates. A configuration error could expand the consequences of an attack.
Expanding the Attack Surface and Conclusions
The incident demonstrates that protection is needed not only for models and code but also for data, configurations, loaders, and automated pipelines. Every component capable of interpreting external content becomes a potential entry point. Hugging Face recommends that clients replace access tokens and check account activity — although there is no direct evidence of public model compromise, the final assessment is not complete.
My Expert Opinion: This attack is a wake-up call for the entire industry. Autonomous AI agents capable of performing thousands of operations and migrating between services blur the line between human and machine threats. Anthropic's zero-trust recommendations are becoming not just a best practice but a necessity. Platforms must prepare for the next breach to be fully automated, and the only way to counter it is to use AI for both defense and investigation, but with clear access protocols.