Hugging Face has confirmed an unauthorized intrusion into part of its production infrastructure that allowed an attacker to execute code inside the dataset processing pipeline, escalate privileges, and move laterally across multiple internal clusters during a weekend.
The company attributes the attack to an autonomous AI agent system. The entry point was not a model but a malicious dataset that activated two distinct code-execution vectors: a dataset loader capable of remote code execution and a template injection flaw in the dataset configuration itself.
From this foothold the attacker collected cloud and cluster credentials and performed lateral movement between internal environments. Hugging Face states it has found no evidence of manipulation of public models, datasets, or user-facing Spaces, nor any signs of alteration to container images or published packages.
The company is still investigating whether partner or customer information was reached and has committed to direct notification if any impact is confirmed.
Immediate containment actions included closing the code-execution routes used in the initial access, rebuilding compromised nodes, and revoking and rotating all affected credentials and tokens. Additional hardening of cluster admission controls was implemented to reduce the risk of similar artifacts entering the pipeline again.
In a notable detail, the forensic team processed more than 17,000 attacker events using LLM-based analysis agents to reconstruct the timeline, extract indicators of compromise, and identify affected credentials. The investigation ultimately relied on an open-weight model running on internal infrastructure after commercial models refused portions of the work due to safety guardrails triggered by real attack commands and artifacts.
For users and organizations, Hugging Face recommends immediate rotation of all access tokens, especially those embedded in CI/CD systems, automation scripts, or third-party integrations. Organizations should also inventory every secret that depends on these tokens, remove embedded credentials from repositories and pipelines, and enforce least-privilege access to limit potential damage.
The incident highlights a critical lesson for the AI ecosystem: the attack surface extends far beyond the model itself. Data pipelines and dataset processing have become high-value targets, and any shortcut that permits arbitrary code execution or template interpretation can serve as a direct path to internal credentials and systems.
