Attack on Hugging Face: Autonomous AI agents used for the first time to hack infrastructure
Hugging Face, a platform for developing and hosting AI models, has revealed details of an unprecedented attack in which attackers deployed an autonomous agent system. The incident, which affected part of the working infrastructure, marks a new stage in the evolution of cyber threats: attacks can now be carried out not by a human, but by a software agent capable of making independent decisions and moving across networks.
Attack Scenario: From Dataset to Cloud Clusters
The entry point was a dataset processing pipeline. The malicious dataset used two mechanisms to execute code: a remote loader and command injection through a configuration template. After running the code on the processing server, the attacker escalated privileges to an infrastructure node, collected credentials for cloud services and clusters, and then moved into internal environments. It is important to note that this is not a classic infected file upload — the dataset served as a means of delivering commands to a system that was supposed to automatically analyze the content.
Hugging Face promptly fixed the vulnerabilities, rebuilt the compromised nodes, and revoked the affected keys. The company also began a large-scale replacement of secrets and strengthened cluster access policies.
Autonomous Agents: Thousands of Operations Without Human Control
According to Hugging Face, the campaign was managed from start to finish by an autonomous agent system. It performed thousands of operations through a network of short-lived, isolated environments. The command-and-control infrastructure was hosted on public services and could autonomously migrate between them, making it extremely difficult to block: removing one element does not stop the entire campaign.
However, the company does not claim the attack occurred without human involvement. It is unknown who set the initial goal, controlled the system, and made key decisions. It is also undisclosed whether the agents operated through a compromised commercial model or an open-weight system.
AI in Defense: Anomalies and Investigation
The incident was detected by Hugging Face's anomaly analysis system, which uses language models for initial processing of security logs. To reconstruct the timeline, the company deployed AI agents over the full log of the attacker's actions, containing more than 17,000 records. The agents correlated events, identified indicators of compromise, and determined the affected credentials. According to Hugging Face, this work took hours instead of several days.
Interestingly, in the initial phase, the company attempted to use advanced models through commercial APIs. However, the providers' security restrictions blocked the requests, as the systems could not distinguish an incident investigation from an attempt to seek help with hacking. Hugging Face did not name the services that denied processing.
After the rejections, the investigation was moved to its own infrastructure, using the open-weight GLM 5.2 model from Z.ai (MIT license). This allowed for the analysis of dangerous content without automatic blocking and without leaving the internal environment. However, as the company rightly notes, an open model is not inherently safer — the responsibility for infrastructure and access management falls on the organization.
Conclusions and Recommendations
The incident showed that it is necessary to protect not only models and code. Data, configurations, loaders, agent tools, and automated pipelines pose a danger. Every component capable of interpreting external content or executing commands becomes a potential entry point. The risk is especially high in systems where an agent has access to cloud resources and credentials.
Hugging Face recommended that customers replace access tokens and check recent account activity. There is no direct evidence of compromise of public models or user datasets yet, but the final assessment of the consequences is not complete.
Expert Opinion: This attack is a wake-up call for the entire industry. We are entering an era where the attacker may not be a human, but an autonomous agent capable of operating on a scale unattainable for a lone hacker. The principle of zero trust for agents, previously discussed by Anthropic, is becoming not a recommendation but a necessity. Platforms working with AI will have to rethink their threat models, including attacks initiated by AI systems themselves.