An AI agent breached Hugging Face before an AI defender caught it: What users should do next

Hugging Face disclosed that an unknown agentic AI launched an automated attack by embedding malicious code in a dataset to exploit a remote code dataset loader and a template injection, gaining node-level access, moving laterally, and stealing cloud and cluster credentials (over 17,000 related events). Hugging Face's own AI tools largely detected and reconstructed the incident; the company fixed the root vulnerability, rebuilt compromised nodes, rotated secrets, added guardrails, and is assessing whether partner or customer data was affected while advising users to rotate access tokens and monitor accounts.