Hugging Face warns an autonomous AI agent hacked its network

Hugging Face disclosed a production infrastructure breach where attackers used a malicious dataset to exploit code-execution vulnerabilities, steal cloud and cluster credentials, and move laterally; the campaign was executed by an autonomous agent framework running thousands of actions in short-lived sandboxes. The company has closed the vulnerable execution paths, evicted the attacker, rebuilt compromised nodes, rotated affected credentials, deployed improved detection, and engaged law enforcement and external forensics while investigating potential impact to partners and customers.