AI Agents Turned Into Attackers: Hugging Face Reveals Autonomous Intrusion Campaign

Hugging Face disclosed that an autonomous AI agent breached part of its production infrastructure by exploiting code-execution flaws in a data-processing pipeline, compromising processing workers, stealing cloud and cluster credentials, and accessing a limited set of internal datasets; the company contained the intrusion, rotated credentials, rebuilt affected systems, engaged external forensics, and advised users to rotate tokens while investigating the scope and impact.