Hugging Face confirms breach affected internal datasets and credentials, urges users to take action

Hugging Face disclosed a breach in which a malicious dataset exploited a vulnerability to execute code on its servers, allowing attackers to escalate privileges and access internal systems and service credentials; the company revoked and rotated credentials, patched the issue, and enlisted forensic help and law enforcement, but the extent of any customer data theft remains unclear.