Hugging Face AI Breach: Autonomous Agent Steals Credentials

Hugging Face has reported a major cybersecurity incident involving an autonomous AI agent. This agent reportedly compromised parts of its production infrastructure. Attackers exploited vulnerabilities in Hugging Face's data-processing pipeline through a malicious dataset. This allowed code execution, unauthorized access to internal datasets, and the theft of service credentials. The AI-driven attack escalated privileges, moved across internal clusters, and performed thousands of automated actions over one weekend. This demonstrates how autonomous AI agents can conduct sophisticated cyber operations with minimal human input. Hugging Face states there is no evidence of tampering with public models, datasets, or Spaces, and its software supply chain remains secure. The company has patched vulnerabilities, rebuilt systems, and rotated compromised credentials. This incident highlights a new cybersecurity era where organizations must prepare for AI-versus-AI defense.