World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent
Summary: Hugging Face detected and responded to unauthorized access to its production infrastructure, where an autonomous AI agent framework gained entry through a malicious dataset that abused two code execution paths in its remote code dataset loader and a template injection in a dataset configuration. The attacker escalated to node-level access, collected cloud and cluster credentials, and moved laterally into several internal clusters over a weekend, executing many thousands of individual actions across a swarm of short-lived sandboxes with self-migrating command-and-control staged on public services.
Bottom line: Hugging Face's own forensic work was blocked because Western frontier models refused requests containing real attack commands and exploit payloads, forcing it to use Z.ai's GLM 5.2 - while the attacker operated under no usage policy at all. The company's stated lesson is to have a capable model vetted and runnable on your own infrastructure before an incident, so guardrail lockout does not stall response and attacker data and credentials do not leave your environment.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026