Hugging Face, the open-source AI platform that millions of developers use to share and download machine learning models, disclosed on July 20 that it was the target of a sophisticated attack — and the attacker was itself an AI. An autonomous agent framework penetrated Hugging Face’s production data-processing pipeline by exploiting two code-execution flaws: a template injection bug and a vulnerability in a remote code dataset loader. Once inside, the AI agent launched thousands of individual actions across a swarm of short-lived sandboxes, moving laterally through internal systems, stealing cloud and cluster credentials, and accessing internal datasets.
The good news is that Hugging Face says it found no evidence that public models, public datasets, or the Spaces product were tampered with, and its software supply chain checked out clean. The bad news: the attackers had internal cloud credentials and access to internal data before being detected, and the investigation into whether any partner or customer information was exposed is still ongoing. The incident is a stark demonstration of how autonomous AI systems can now be weaponized to conduct fast, parallelized attacks that would take a human team days to execute manually.
How to check if you’re affected
Affected versions include any Hugging Face API token or access key that was active before July 20, 2026 — particularly tokens with write permissions or access to private repositories.
If you use Hugging Face as a developer or in your organization:
- Rotate your access tokens now. Go to your Hugging Face account settings, navigate to Access Tokens, and regenerate any tokens your applications use. Update those tokens in your code, CI/CD pipelines, and anywhere else they are stored.
- Review your account activity. Check your Hugging Face account for unexpected model uploads, downloads of private datasets, or changes to your organization’s settings.
- Audit secrets in your environment. If you stored Hugging Face tokens alongside other credentials (cloud keys, database passwords), treat the full set as potentially exposed and rotate them too.