AI Agent Attack on Hugging Face: A New Frontier in Cybersecurity
The cybersecurity of artificial intelligence platforms is entering a new era. Hugging Face, the leading platform for hosting AI models, has faced an attack that is radically different from anything we have seen before. Using an autonomous agent system, the attacker managed to infiltrate the company's operational infrastructure, gaining access to a limited set of internal data and service accounts.
The key feature of this incident was that the attack was not aimed at modifying public models or datasets — checks confirmed their integrity. Instead, the target was the data processing infrastructure itself. The entry point was a dataset processing pipeline: a malicious dataset used a remote loader and command injection through a configuration template, allowing code execution on the server. After that, the attacker escalated privileges, collected cloud service credentials, and spread across internal networks.
Autonomous System: Thousands of Operations Without Direct Control
Hugging Face characterized this campaign as fully managed by an autonomous agent system. It performed thousands of operations through a network of short-lived isolated environments. The management infrastructure was hosted on public services and could autonomously migrate between them, making blocking particularly difficult — removing one element does not stop the entire campaign. It is important to emphasize that the company does not rule out human involvement in setting goals or making key decisions, but the attack process itself was automated.
Response: AI vs. AI
To investigate the incident, Hugging Face used its own AI tools. An anomaly analysis system based on language models identified the threat, and then AI agents were launched to reconstruct the timeline of events. The attacker's activity log contained over 17,000 entries. The agents correlated events, highlighted indicators of compromise, and identified affected credentials, completing the task in hours instead of days. Interestingly, at the initial stage, commercial AI systems refused to process requests, unable to distinguish the incident investigation from an attempted hack. Ultimately, the company was forced to use the open-source model GLM 5.2 from Z.ai, deployed locally, which allowed analyzing dangerous content without blocks.
Conclusions and Lessons for the Industry
This case demonstrates a critical expansion of the attack surface on AI platforms. Now, the threat comes not only from models and code but also from data, configurations, loaders, agent tools, and automated pipelines. Every component capable of interpreting external content becomes a potential entry point. Hugging Face's recommendations to replace access tokens and check account activity are only a temporary measure.
As an analyst, I believe we are on the verge of a new paradigm in cybersecurity. Attacks using autonomous AI agents are not the future but a reality. The industry urgently needs to rethink its approaches to defense, implementing zero-trust principles and developing specialized tools for incident investigation capable of operating in conditions where the adversary itself is artificial intelligence. Players who fail to adapt risk falling behind.