Hugging Face Security Breach Exposes Internal Datasets, Credentials, and Tokens

Severity

Medium

Hugging Face disclosed a security incident on July 16, 2026, involving unauthorized access to parts of its production infrastructure. The breach affected a limited number of internal datasets and several service credentials. The company is still investigating whether any customer or partner information was exposed and stated that affected parties will be notified if necessary. According to Hugging Face, there is no evidence that publicly available models, datasets, Spaces, container images, or published software packages were modified. The company also confirmed that its software supply chain remains uncompromised.

How?

The attack originated from Hugging Face’s dataset-processing environment, which is designed to process untrusted content. The attacker exploited two separate code execution vulnerabilities: a vulnerable remote-code dataset loader and a template injection flaw within dataset configurations. By chaining these weaknesses together, the attacker was able to execute malicious code on a processing worker.

After gaining initial access, the threat actor escalated privileges, obtained node-level access, harvested cloud and cluster credentials, and moved laterally across multiple internal clusters. Hugging Face described the intrusion as an autonomous AI-driven campaign, where an agent framework coordinated thousands of actions from short-lived sandbox environments. The attackers also used self-migrating command-and-control infrastructure hosted on public services, making detection and tracking significantly more difficult.

The intrusion was initially detected by Hugging Face’s AI-assisted anomaly detection system, which correlated suspicious activity across multiple telemetry sources. Investigators then used LLM-powered analysis agents to process more than 17,000 attacker events, reconstruct the attack timeline, identify indicators of compromise (IOCs), determine potentially exposed credentials, and separate genuine attacker actions from decoys. This reduced an investigation that would normally take several days to only a few hours.

During the forensic investigation, Hugging Face found that commercial frontier-model APIs refused to process prompts containing real attack commands and exploit artifacts due to built-in safety restrictions. To overcome this limitation while ensuring sensitive attacker data remained internal, the company performed its analysis using the self-hosted GLM 5.2 open-weight model.

Following the incident, Hugging Face closed the vulnerable dataset execution paths, removed the attacker’s access, rebuilt compromised systems, revoked and rotated affected credentials, strengthened cluster admission controls, expanded security guardrails, enhanced monitoring and alerting capabilities, and engaged external forensic experts and law enforcement to support the ongoing investigation.

Recommendations

This incident demonstrates that AI data processing pipelines including dataset loaders, templates, and model-processing environments have become attractive attack surfaces for sophisticated adversaries. The use of autonomous AI agents also highlights how attackers can automate reconnaissance, credential theft, privilege escalation, and lateral movement at a much larger scale and faster pace than traditional attacks.

As a precaution, Hugging Face advises users to rotate their access tokens and review recent account activity. Organizations deploying AI platforms should strengthen protections around dataset processing, continuously monitor privileged environments, promptly rotate exposed credentials, and treat AI infrastructure as a critical component of their overall cybersecurity posture.

Source

https://gbhackers.com/hugging-face-security-breach-exposes-internal-datasets/