Hugging Face Hacked: AI Agent Breaches Data Pipeline

Hugging Face reports its data pipeline was attacked by an "autonomous AI agent system." This security incident used a malicious dataset to run code on a processing worker, allowing the threat actor to harvest cloud and cluster credentials. Hugging Face is still assessing if partner or customer data was affected and will contact any impacted parties. They found no evidence of tampering with public, user-facing models, datasets, or Spaces. The company has fixed the vulnerability and removed the attacker's access. This incident shows that AI-driven attacks are no longer theoretical. It highlights the need for organizations to use AI for defense to keep pace with these machine-speed campaigns.