AI Agent hacks into Hugging Face with 17,000 autonomous actions!

Hugging Face announced that its production environment was hacked by an AI agent. This happened over the weekend. An attacker managed to gain access using a malicious dataset. They leveraged two separate code execution flaws: remote datasets and template injection.

This AI agent performed over 17,000 discrete actions within sandboxed environments over a series of short-lived C2 infrastructure deployed on public services. Hugging Face acknowledged that some of their internal datasets were accessed without authorization and that credentials were stolen. Other services such as public models, datasets, or Spaces were not impacted, nor was there any tampering with the software supply chain.

During the investigation, however, the security team encountered an interesting problem: they wanted to use commercial API models to perform forensics, but the models wouldn’t respond. Their guardrails detected the presence of exploit and attack information, which is considered inappropriate, and blocked their requests. In the end, they resorted to using the open source GLM 5.2 model, which is deployed on their servers and doesn’t have any limitations. They finished the investigation in a few hours instead of days.

They’ve fixed the code execution vulnerabilities, revoked the attacker’s access, recovered the affected nodes, and rotated the credentials. Everyone who uses their platform should rotate their access tokens as soon as possible. This is one of the first known cases of large-scale AI agent cyberattacks.