Hugging Face says it detected ‘unauthorized access’ to its AI model hosting platform

Hugging Face disclosed that its security team detected unauthorized access to Spaces secrets—private tokens and keys used by hosted AI apps—and has revoked affected tokens, notified impacted users, and advised all users to rotate keys and consider finer-grained tokens; the company is investigating with external forensic specialists and has reported the incident to law enforcement and data protection authorities. The report also references earlier discovered vulnerabilities and suspicious uploads on the platform, which have increased scrutiny of Hugging Face’s security practices.