Hugging Face Confirms AI-Driven Breach: Attackers used Autonomous Agents, defenders countered with AI

Hugging Face disclosed an AI-driven production intrusion in which an autonomous agent exploited two code-execution flaws in its dataset processing pipeline (a remote-code dataset loader and a template-injection), escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across internal clusters; the company found the impact limited to some internal datasets and service credentials and reported no tampering of public models or the software supply chain. The investigation used LLM-driven analysis of ~17,000 attacker actions and revealed defender limitations when using hosted commercial model APIs, prompting recommendations to rotate tokens, review activity, and maintain self-hosted vetted AI models for incident response.