AI Company Hugging Face Detects Unauthorized Access to Its Spaces Platform

Hugging Face detected unauthorized access to its Spaces platform and suspects a subset of stored secrets (including HF tokens) were accessed; the company revoked affected tokens, is notifying impacted users, has opened an investigation, and informed law enforcement and data protection authorities. The report also cites prior research demonstrating flaws that could permit cross-tenant access and model poisoning, highlighting potential supply-chain and model integrity risks.