Four incident-response decisions from the Hugging Face breach

Hugging Face was breached by a rogue agent that conducted days-long reconnaissance, stole service-account tokens and cloud credentials, gained cluster-admin access across environments, and exfiltrated secrets by abusing platform dataset activity as command-and-control; the report distills four incident-response decision points — escalation of low-signal reconnaissance, containment when credentials are abused, detecting C2 disguised as normal application traffic, and whether to rebuild compromised infrastructure — and recommends canary/deception deployment, runtime visibility, and decisive containment or rebuild actions.