On July 16, Hugging Face disclosed that intruders breached part of its production infrastructure via a malicious dataset, gaining unauthorized access to a limited set of internal datasets and multiple service credentials. The intruders used a code-execution path in data processing to run code on workers, obtaining node-level access. From there, they acquired cloud and cluster credentials and moved laterally into multiple internal clusters, the company said. Hugging Face describes the campaign as having been driven by an autonomous AI agent framework that carried out thousands of actions across short-lived sandboxes. What stands out in this disclosure is the company's explanation that the infrastructure used to process publicly submitted data accelerated post-intrusion reconnaissance and lateral movement.
A malicious dataset used processing workers as a foothold
According to Hugging Face's account, the initial intrusion began by exploiting two code-execution paths: a remote-code dataset loader and a template injection in dataset configuration. The malicious dataset executed code on a processing worker, and from there the attackers progressed to node-level access, credential acquisition, and lateral movement into internal clusters. The pipeline that inspects and transforms externally submitted data is the behind-the-scenes machinery that makes it possible to publish models and datasets. When the workers running that pipeline hold credentials reaching into the wider internal environment, input safety and credential isolation become inseparable concerns.
The company states that the attackers used an autonomous AI agent framework to execute thousands of individual actions across short-lived sandboxes, and placed a mobile command-and-control (C2) presence on a public-facing service. Which large language model (LLM) was used remains unknown. This disclosure does not prove the danger of any specific model. However, in attacks that can repeat trial, environment reconnaissance, and pivoting after failure at machine speed, detection systems built around the assumption of human-paced operational intervals will inevitably lag behind.
No evidence of tampering with public assets; customer data impact still under assessment
The confirmed impact is unauthorized access to a limited set of internal datasets and multiple service credentials. Hugging Face states there is no evidence of tampering with publicly available models, datasets, or Spaces, and that it has verified the software supply chain—comprising container images and public packages—remains clean. Meanwhile, whether partner or customer data was affected is still under assessment. The company says it will contact affected parties directly.
This distinction matters for how users should respond. As a precaution, the company recommends rotating access tokens and reviewing recent account activity. The absence of evidence of tampering with public assets does not mean users' own credentials or private data are necessarily safe. Organizations using the Hub should first inventory token permissions and issuance targets, then cross-reference any anomalous usage history against their own internal audit logs.
How the unit of defense changed since the 2024 Spaces incident
Hugging Face also disclosed a suspected unauthorized access incident involving Spaces secrets in May 2024. At that time, it revoked some of the HF tokens included in the exposed secrets and recommended users update keys and tokens and migrate to fine-grained tokens. This time as well, the company is revoking and rotating credentials and tokens, but the response does not stop there. It has closed the code-execution path used in the initial intrusion, rebuilt the compromised nodes, and tightened cluster access controls.
Comparing the two incidents shows that the scope of defense has expanded—from managing secrets themselves to securing the execution environments that can reach those secrets. The official Datasets documentation notes that custom builders can be used when a dataset includes a script, a feature retained mainly for backward compatibility. This time, the company identified the remote-code dataset loader as one of the intrusion vectors. Even when an execution feature is retained for compatibility's sake, unless the credentials a processing worker can reach—and how far an attacker can move after a breach—are designed separately, fixing the entry point alone will not narrow the scope of damage.
Tracking over 17,000 events with AI
Hugging Face says its detection infrastructure, which uses an LLM to triage security telemetry, correlated anomalous signals and uncovered the intrusion. The intruders' activity logs exceeded 17,000 entries, and the company used LLM-driven analysis agents to reconstruct the timeline, identify indicators of compromise, and determine which credentials had been touched. In investigations tracking thousands of automated actions, the sheer volume of logs itself becomes a constraint on the initial response. The defenders likewise used AI to reconstruct the scope of impact from that volume of logs.
However, the company says the first commercial frontier API model it tried blocked analysis requests—which contained attack commands, exploit payloads, and traces of the C2 activity—via its safety guardrails. Ultimately, the company ran the open-weight GLM 5.2 on its own infrastructure to conduct the forensics. Hugging Face states this is not a rebuttal of safety measures, but rather an argument that organizations should have pre-vetted model execution environments ready that can handle real attack data and credentials without sending them outside. Companies incorporating AI into incident response need to decide, beyond peacetime accuracy evaluations, which inputs can be analyzed in which environments during an emergency.
Hugging Face continues to investigate with outside forensic specialists and has reported the incident to law enforcement. The final scope of impact will become clearer through the company's individual notifications and through whether anomalous token usage stops following the rotation.