Open-source artificial intelligence platform Hugging Face has disclosed a cybersecurity incident in which an autonomous AI agent system was used to compromise parts of its internal infrastructure. The attack marks a significant development in the evolving landscape of AI-powered cyber threats, highlighting the risks associated with increasingly capable autonomous systems.
The company confirmed that it detected unauthorized activity targeting its production environment and quickly launched an investigation. According to Hugging Face, the intrusion resulted in unauthorized access to a limited number of internal datasets and several service-related credentials.
However, the company stated that there is currently no evidence that attackers modified or accessed publicly available models, datasets, user-facing Spaces, or elements of its software supply chain.
Attack Began Through Malicious Dataset Processing
Investigators identified the initial entry point as Hugging Face’s data processing pipeline. The attackers reportedly used a specially crafted dataset designed to exploit code execution mechanisms within the platform’s processing environment.
The malicious dataset abused two separate execution paths: a remote code-loading feature and a template injection flaw inside dataset configuration files. These weaknesses allowed attackers to execute code on a processing worker and gain deeper access to the underlying environment.
After obtaining access, the threat actors reportedly escalated privileges, collected cloud and cluster credentials, and moved laterally across multiple internal systems.
Autonomous AI Framework Powered the Campaign
What makes the incident particularly notable is the use of an autonomous AI agent framework to conduct the attack. Hugging Face said the operation involved thousands of automated actions carried out across temporary sandbox environments.
The attackers reportedly used self-migrating command-and-control techniques hosted through public services, allowing the campaign to continue while avoiding traditional detection methods.
The company has not confirmed which large language model was used to power the malicious AI agents. Security researchers believe the incident demonstrates how autonomous AI systems could become a new tool for sophisticated cyber operations.
Hugging Face Implements Security Improvements
Following the discovery, Hugging Face said it eliminated the attacker’s access, rebuilt affected systems, and rotated compromised credentials and security tokens.
The company also introduced additional protective measures, including:
- Removing unauthorized access paths and rebuilding impacted infrastructure.
- Rotating affected credentials and expanding secret management procedures.
- Strengthening cluster security controls and admission policies.
- Improving monitoring systems to provide faster threat detection and response.
Hugging Face has also advised users and customers to rotate their access tokens and review account activity for any unusual behavior.
AI Security Challenges Highlighted by the Incident
The company noted that the investigation revealed broader challenges in using AI tools during cybersecurity response efforts. Hugging Face said it used Z.ai’s GLM model for forensic analysis after other hosted AI systems blocked requests involving real attack commands and malicious artifacts because of safety restrictions.
According to Hugging Face, defenders may need access to trusted AI models that can operate within their own infrastructure during security investigations. Such systems could help organizations analyze threats while avoiding the risks of sharing sensitive attack data externally.
The incident underscores a growing cybersecurity challenge: while AI systems can help organizations defend against threats, they can also be leveraged by attackers to automate complex operations at unprecedented speed and scale.
As autonomous AI agents become more advanced, security experts expect organizations to invest heavily in stronger AI governance, improved monitoring, and specialized defenses designed for AI-driven attacks.
