Hugging Face, the open-source platform used to host and share machine-learning models and datasets, discloses that its production infrastructure was breached by an autonomous AI agent system. In statements and follow-up reporting, the company says the incident was identified earlier in the week and that it involved unauthorized access to a limited set of internal datasets. The intrusion also includes access to several credentials used by its services.
Multiple outlets report that the attack was carried out by an “agentic” or autonomous AI system using a malicious dataset uploaded to the platform, which exploited a security weakness. Hugging Face also says its own automated defenses detected the intrusion and helped contain and investigate it, with reporting describing this as a case where an AI system identifies the compromise.
As of the disclosures covered in these reports, Hugging Face is still determining whether any customer or partner data was accessed or stolen. The incident is described as one of the first publicly confirmed examples of an autonomous AI agent being used to breach a major AI platform, and it has prompted discussion of safeguards and user actions.
