What should Hugging Face users do right now?

Hugging Face is asking every user to rotate their access tokens and review recent activity on their accounts. The company says there is no evidence that public models, datasets, or Spaces were tampered with, but service credentials were exposed. Users with specific concerns can contact security@huggingface.co.

How did the attackers get in?

The intrusion started in the Hugging Face dataset-processing pipeline. A malicious dataset abused two code-execution paths — a remote-code dataset loader and template injection in a dataset configuration — to run code on a processing worker. From there the attacker escalated to node-level access and moved laterally into several internal clusters over a weekend.

Why is this incident different from previous Hugging Face security events?

This is the first disclosed intrusion where every action, from initial access through lateral movement, was executed by an autonomous AI-agent framework rather than a human operator. Hugging Face recorded 17,000+ attacker events across a swarm of short-lived sandboxes with self-migrating command-and-control staged on public services.

Which AI model was the attacker using?

Hugging Face says it does not know which model powered the attacker's agents — it could be a jailbroken hosted model or an unrestricted open-weight one. Either way, the attacker was bound by no usage policy, while Hugging Face's own forensic requests were initially blocked by commercial safety filters until it switched to GLM 5.2 running on its own infrastructure.

What did Hugging Face do to close the hole?

Hugging Face closed the two dataset code-execution paths used for initial access, revoked and rotated affected credentials and tokens, rebuilt compromised nodes, deployed stricter cluster admission controls, engaged external cybersecurity forensic specialists, and reported the incident to law enforcement.

Hugging Face · 2026-07-16 · major

Hugging Face — production infrastructure hit by autonomous AI-agent intrusion

Hugging Face disclosed an intrusion into part of its production infrastructure that was carried out end to end by an autonomous AI-agent framework. Access was limited to internal datasets and service credentials; users are told to rotate access tokens.

Hugging Face July 2026 security incident disclosure thumbnail

First disclosed autonomous AI-agent intrusion of a major AI platform — internal data touched, tokens compromised, users urged to rotate.

Key specs

Attacker events analyzed	17,000+
Public assets tampered	0

Quick facts

Disclosed	July 16, 2026
Vector	Malicious dataset abused two code-execution paths in dataset processing
Reach	Limited internal datasets + several service credentials
Public models/datasets/Spaces	No evidence of tampering
Forensic model	GLM 5.2 (open weights, self-hosted)
User action	Rotate access tokens; review recent account activity

What is it?

On July 16, Hugging Face disclosed a security incident in which part of its production infrastructure was compromised. What sets this incident apart is that every step, from initial code execution to lateral movement across internal clusters, was driven by an autonomous AI-agent framework rather than a human operator.

How does it work?

The attacker's opening move was a malicious dataset that abused two code-execution paths in Hugging Face's dataset processing — a remote-code dataset loader and a template-injection bug in dataset configuration. Code ran on a processing worker; the agent framework then escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. Hugging Face detected the campaign through AI-assisted anomaly detection, then reconstructed the timeline by feeding 17,000+ recorded attacker events to GLM 5.2 on its own hardware after commercial APIs refused the forensic requests.

Why does it matter?

This is the industry-forecast 'agentic attacker' turning up in the wild against one of the most important AI infrastructure providers. The attacker was bound by no usage policy while Hugging Face was initially blocked by safety filters, which flips the usual defender-versus-attacker cost curve. Every user of the platform now needs to rotate access tokens and audit recent activity.

Who is it for?

Anyone with a Hugging Face account or CI that pushes to the Hub; security teams building a threat model that assumes autonomous LLM-driven attackers.

Frequently asked questions

What should Hugging Face users do right now?: Hugging Face is asking every user to rotate their access tokens and review recent activity on their accounts. The company says there is no evidence that public models, datasets, or Spaces were tampered with, but service credentials were exposed. Users with specific concerns can contact security@huggingface.co.
How did the attackers get in?: The intrusion started in the Hugging Face dataset-processing pipeline. A malicious dataset abused two code-execution paths — a remote-code dataset loader and template injection in a dataset configuration — to run code on a processing worker. From there the attacker escalated to node-level access and moved laterally into several internal clusters over a weekend.
Why is this incident different from previous Hugging Face security events?: This is the first disclosed intrusion where every action, from initial access through lateral movement, was executed by an autonomous AI-agent framework rather than a human operator. Hugging Face recorded 17,000+ attacker events across a swarm of short-lived sandboxes with self-migrating command-and-control staged on public services.
Which AI model was the attacker using?: Hugging Face says it does not know which model powered the attacker's agents — it could be a jailbroken hosted model or an unrestricted open-weight one. Either way, the attacker was bound by no usage policy, while Hugging Face's own forensic requests were initially blocked by commercial safety filters until it switched to GLM 5.2 running on its own infrastructure.
What did Hugging Face do to close the hole?: Hugging Face closed the two dataset code-execution paths used for initial access, revoked and rotated affected credentials and tokens, rebuilt compromised nodes, deployed stricter cluster admission controls, engaged external cybersecurity forensic specialists, and reported the incident to law enforcement.

Try it

Rotate tokens: https://huggingface.co/settings/tokens