The machines are now hacking each other. Hugging Face, the world’s largest hub for open AI models, says an autonomous AI agent broke into its production infrastructure. Its own AI defences spotted the intrusion and picked it apart.
The company disclosed the incident in a statement on 16 July. It called the attack different from anything it had handled before. The reason: an autonomous agent system ran it, end to end.
“We detected and dissected it largely with AI of our own,” Hugging Face said.
How the agent got in
The break-in started in the data pipeline, the part of an AI platform that ingests datasets. A malicious dataset abused two code-execution paths in Hugging Face’s processing system. That let it run code on one of the company’s workers.
From there, the attacker climbed. It won deeper access to the machine, then harvested cloud and cluster credentials. Over a single weekend, it moved sideways into several internal clusters.
The scale is the striking part. The campaign ran across a swarm of short-lived sandboxes. It fired off many thousands of actions and left more than 17,000 recorded events. Its command-and-control servers kept moving on their own, hidden on public services.
Hugging Face said the framework appeared to be built on an agentic security-research harness. It does not know which model powered the attack. Nor does it know whether that model was a jailbroken commercial one or an unrestricted open-weight one.
The attack matches what the industry has been forecasting. Hugging Face said it fit the “agentic attacker” scenario security teams have warned about for months. The Hacker News, which covers the sector, called it an ironic hit on the world’s largest AI model hub.
What the attacker took
The damage was real but contained, on Hugging Face’s account. The agent reached a limited set of internal datasets and several credentials used by its services.
Crucially, the company found no sign the attacker touched public models, datasets, or Spaces. Its software supply chain, meaning its container images and published packages, came back clean. Hugging Face is still checking whether any partner or customer data was caught up in the breach.
As a precaution, it told users to rotate their access tokens and review recent account activity. It has since closed the vulnerability, rebuilt the compromised machines, rotated its secrets, and reported the incident to law enforcement.
AI caught the AI
The defence is where the story turns. Hugging Face runs an anomaly-detection pipeline that uses an LLM to triage security data. It sorts real threats from the daily noise. That system flagged the compromise.
To make sense of tens of thousands of automated actions, the team then set its own analysis agents loose on the full attack log. The AI rebuilt the timeline, pulled out indicators of compromise, and mapped every credential the attacker had touched. It also split genuine damage from decoy activity meant to waste responders’ time.
The payoff was speed. Hugging Face said it did in hours what would normally take days, matching the attacker’s pace. In a fight at machine speed, that gap matters. It is the same bet Microsoft and others are now making on the defensive side.
The guardrail twist
Then came a problem Hugging Face did not see coming. When its team tried to analyse the attack, it first reached for frontier models behind commercial APIs. The models refused.
Forensic work means feeding a model real attack commands, exploit code, and other hostile artefacts. The safety guardrails on hosted models could not tell an incident responder from an attacker. So they said no.
Hugging Face switched to GLM 5.2, an open-weight model from the Chinese lab Z.ai, and ran it on its own hardware, The Stack reported. It worked. It also kept the attacker’s data and the exposed credentials inside the company’s walls.
Hugging Face drew a pointed lesson from that. “The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried,” it said. Its advice to other defenders: keep a capable model you can run on your own infrastructure vetted and ready before an incident hits.
The company stressed it was not arguing against safety measures on hosted models, and said it had passed the feedback to the providers involved. It did not name which ones it had tried.
A charged moment for open models
The choice of a Chinese model lands at a loaded time. Hugging Face published its report the same day Moonshot unveiled Kimi K3, billed as the largest open-weight AI model yet. Open models from Chinese labs, among them Z.ai’s GLM line, have been closing the gap on their US rivals on both cost and capability.
A warning shot
The wider point outlasts this single breach. Autonomous, AI-driven attack tools are no longer a thought experiment. They cut the cost of running a patient, multi-stage campaign, and they run at machine speed.
For anyone running an online platform, Hugging Face argued, the data and model layer is now a front-line target. Its own answer was to fight AI with AI. On this evidence, defenders may not have much choice.
Get the TNW newsletter
Get the most important tech news in your inbox each week.