On July 16, Hugging Face disclosed a compromise affecting part of its production infrastructure. The initial entry point was a malicious dataset, while the subsequent intrusion was, according to the company, carried out by an autonomous agent framework.
Attack Chain
The dataset abused two code-execution paths: a remote-code dataset loader and template injection in a dataset configuration. Code ran on a processing worker, after which the attacker obtained node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.
The agent framework executed thousands of operations across a swarm of short-lived environments, while its command-and-control infrastructure migrated between public services. The underlying LLM remains unknown. There is also no independent confirmation that a human operator was absent from every stage of the campaign.
What the Patches Reveal
