Hugging Face breached by autonomous AI agent

Hugging Face disclosed an intrusion where a malicious dataset abused code-execution paths in its dataset processing pipeline to run remote code, escalate to node-level access, harvest cloud and cluster credentials, and move laterally across internal clusters; the company attributes the attack to an autonomous AI agent framework and reports no evidence so far of partner or customer data access or tampering with public models. Hugging Face blocked the dataset execution paths, evicted the attacker, rebuilt compromised nodes, rotated credentials and tokens, tightened cluster admission controls, and used self-hosted LLMs to accelerate forensic analysis and construct a timeline.