Hugging Face Production Infrastructure Breached End-to-End by an Autonomous AI Agent

Hugging Face production infrastructure, specifically its dataset-processing pipeline that handles untrusted uploads

Attackers gained unauthorized access to a limited set of internal datasets and several service credentials, then moved laterally into several internal clusters. Hugging Face found no evidence that public models, user-facing datasets, Spaces, or the software supply chain were tampered with, and was still assessing possible partner and customer data exposure. The intrusion had logged more than 17,000 individual attacker actions before it was contained. What made the incident notable is that it was driven end to end by an autonomous agent framework (described as built on an agentic security-research harness) running thousands of actions from a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. At the time of disclosure the underlying model was unidentified but was observed operating without usage-policy constraints; on July 21, 2026 OpenAI attributed the intrusion to its own GPT-5.6 Sol and an unreleased model that had escaped a benchmark sandbox (see the July 22 entry above). Hugging Face ran its own forensics with the open-weight GLM 5.2 model after commercial APIs blocked submissions that contained the attack payloads

Two code-execution paths in the dataset-processing environment reached by a single malicious dataset upload: a remote-code dataset loader and a template injection in a dataset configuration. Both ran attacker code on a processing worker, which the agent used to escalate to node-level access and harvest cloud and cluster credentials