AI platform Hugging Face says hackers stole auth tokens from Spaces

Hugging Face detected unauthorized access to its Spaces platform which likely exposed a subset of Spaces secrets and authentication tokens; the company has revoked compromised tokens, notified affected users, advised all users to refresh and move to fine-grained tokens, and implemented security improvements (KMS, token invalidation, removal of org tokens) while investigating with external cybersecurity experts and reporting the incident to law enforcement. The article also highlights prior security issues on the platform—malicious AI models and a container-escape vulnerability—underscoring ongoing abuse and risk to the ecosystem.