Hugging Face Confirms Hackers Stole Internal Credentials, Says Attacker Used an AI Agent

Hugging Face, the platform millions of developers use to host AI models and datasets, confirmed last week that its internal systems were breached. The company disclosed the incident in a blog post on Friday, saying it's still investigating whether customer or partner data was exposed.

According to Hugging Face's own account, the attack started with a dataset uploaded to its platform. That dataset exploited a security vulnerability, letting attackers run malicious code on Hugging Face's servers. From there, the attackers escalated their permissions and moved deeper into the company's internal systems, eventually accessing service credentials.

Hugging Face says it has revoked and rotated every credential the attackers touched. It's telling users to do the same, urging anyone with API keys or tokens stored on the platform to rotate them and check their accounts for anything unusual.

The company also says it patched the vulnerability that made the breach possible in the first place.

The AI-agent claim nobody can verify yet

Hugging Face is attributing the attack to what it calls an external AI agent, one that allegedly executed thousands of individual actions across a swarm of short-lived cloud sandboxes, with command-and-control infrastructure that migrated between public services to avoid detection.

It's also unverified. TechCrunch asked Hugging Face for evidence backing up the AI-agent attribution and did not get any by the time of publication. As of Monday morning, July 20, a company spokesperson had not responded to a follow-up request for comment.

What we have is an allegation from the breached company itself, not an independent forensic confirmation. Hugging Face says it has brought in outside cybersecurity forensic specialists and reported the incident to law enforcement, but the investigation results haven't been made public.

If confirmed, an autonomous AI agent running an intrusion across disposable sandboxes with self-migrating infrastructure would represent a significant escalation in how cyberattacks get carried out. If it's not confirmed, it's simply a company's characterization of an incident it's still investigating. Companies have obvious incentives to frame their own breaches in the most technologically sophisticated light rather than as a basic permissions failure.

How Hugging Face says it caught the attack

According to the company, its own anomaly detection systems flagged the intrusion. To analyze the server logs documenting the attack, Hugging Face says it first tried a frontier AI model from a commercial provider, though it didn't name which one. That effort reportedly got blocked by the provider's own safety guardrails.

Hugging Face then switched to a locally-run large language model instead, which it says had the added benefit of keeping sensitive attack logs off an outside company's servers entirely.

This fits a complaint security researchers have raised before: that some frontier models are locked down so tightly that they refuse to engage with cybersecurity questions even when the person asking is trying to defend a network, not attack one. TechCrunch's reporting notes Anthropic's models have drawn this criticism specifically.

Anthropic has been in a running dispute with the Trump administration over export controls on its models, driven by fears they could be repurposed for offensive cyberattacks. The scope and outcome of those export-control discussions remain unclear. Whether that same caution is now making it harder for legitimate defenders to investigate real attacks is an open question the industry hasn't resolved.

What's still unknown

Hugging Face hasn't said whether it conducted a security audit of its systems before the platform launched, and it hasn't answered TechCrunch's questions on that point. It also hasn't confirmed whether any customer datasets, model weights, or partner data were accessed, only that the investigation into that question is ongoing.

For a platform that hosts models and datasets for companies and independent developers alike, that's the detail that actually determines how serious this is. A stolen internal credential is bad. Stolen customer data, or compromised models that got redistributed to unsuspecting users, would be considerably worse.

Until Hugging Face publishes a fuller forensic accounting, or law enforcement or independent researchers weigh in, the AI-agent attribution remains a claim from the victim company, not an established fact.