Hugging Face Breach: AI Agent Steals Credentials

Hugging Face has revealed a security breach involving an autonomous AI agent. This agent compromised part of their production infrastructure, stole service credentials, and moved across internal computing clusters. What's interesting is this AI agent reportedly performed thousands of actions and managed attack environments without continuous human direction. Hugging Face detected the intrusion earlier in July and published details on July 16. The company operates a platform with over two million AI models. The attacker gained unauthorized access to internal datasets and credentials. However, Hugging Face found no evidence that public models, datasets, or applications were modified. They also state their wider software supply chain remains clean. The intrusion began in Hugging Face's dataset-processing infrastructure, using a malicious dataset that exploited two code-execution paths. The bottom line: This incident highlights the potential for AI agents to conduct sophisticated cyberattacks.