MANY MINDEDA rogue agent breached Hugging Face; open models ran the forensics
Hugging Face says parts of its production infrastructure were breached over a single weekend by what it describes as an autonomous AI-agent system. In a disclosure dated July 20, 2026, it says the attacker logged more than 17,000 actions, running a swarm of short-lived sandboxes and self-migrating command-and-control infrastructure hosted on public services.
The way in was a malicious dataset that exploited two code-execution paths in dataset processing: a remote-code loader and a template injection in a dataset's configuration. From there the agent escalated to node level, harvested cloud and cluster credentials, and moved laterally across several internal clusters. Hugging Face says its public models, datasets, and Spaces were not tampered with, and the software supply chain was untouched.
The response matters most for everyone else. Hugging Face used its own LLM-based anomaly detection and analysis agents to finish forensics in hours rather than days. But when the team first reached for frontier models behind commercial APIs, the providers' safety guardrails refused, unable to tell an incident responder from the attacker. The team fell back to an open-weight model, GLM 5.2, run on its own hardware, so the logs and credentials never left its environment. That is the friction: as attacks get automated and cheap, the tooling to answer them is gated by both cost and the guardrails on hosted models.
Hugging Face has closed the exploited paths, rebuilt compromised nodes, rotated credentials, alerted law enforcement, and asked all users to rotate their access tokens. Keep the read tempered: whether partner or customer data was taken was still under investigation; the company does not know which model powered the attack, or whether it was jailbroken hosted or open-weight; and since it sells open models, its lesson that defenders need their own is not disinterested. The account is its own.
Source: The Decoder