Hugging Face Says Autonomous AI Agent System Breached Production Infrastructure

Hugging Face disclosed unauthorized access to parts of its production infrastructure after a malicious dataset exploited two code-execution paths in its dataset-processing system. An autonomous AI agent framework is reported to have carried out the attack end-to-end, obtaining node-level access and cloud/cluster credentials that were used to move laterally; Hugging Face removed access, rebuilt nodes, rotated secrets, and used an open-weight model internally to accelerate forensic reconstruction while finding no evidence public models or packages were altered.