Hugging Face Breached by Autonomous AI Agent

An autonomous AI agent has breached Hugging Face's production infrastructure. This attack exploited two code execution vulnerabilities in the data processing pipeline through a malicious dataset. The AI agent gained unauthorized access to internal datasets and credentials. It orchestrated thousands of individual actions without human intervention. Public models, datasets, and the software supply chain were not affected. Hugging Face used its own AI agents to analyze over 17,000 logged attacker actions, reducing investigation time significantly. This event highlights new challenges for the security industry in detecting and responding to AI-driven attacks.