Hugging Face, the massive open-source AI hub, got a taste of its own medicine last week when an autonomous AI agent broke into its production systems. The company disclosed that the intruder, powered by an unknown large language model, exploited its data processing pipeline to steal internal datasets and service credentials, marking a first-of-its-kind attack where the hacker was itself an AI.

The breach began when a malicious dataset triggered two code execution pathways in Hugging Face's remote code loader and a template injection flaw, allowing the agent to run code on a processing worker. From there, it escalated to node-level access, swiped cloud and cluster credentials, and spread laterally across multiple internal clusters over a weekend. Hugging Face said the attacker's framework orchestrated "many thousands of individual actions across a swarm of short-lived sandboxes," with self-migrating command-and-control hosted on public services. The company stressed that no public models, datasets, or user-facing Spaces were tampered with, and its software supply chain remained intact.

Hugging Face has since patched the code execution pathways, rebuilt compromised nodes, rotated all affected credentials, and deployed stricter cluster admission controls and 24/7 monitoring. It also urged users to rotate their access tokens and review account activity. In a twist, the company turned to Z.ai's GLM 5.2, a Chinese open-weight model, for forensic analysis after Western frontier models refused to process real attack commands due to their safety guardrails. "This experience points to a gap worth planning for," Hugging Face noted, warning that defenders need a capable, unrestricted model on their own infrastructure ready for incident response to avoid guardrail lockout and keep sensitive data in-house.

Source: The Hackers News