Hugging Face discloses attack on its own infrastructure carried out by an autonomous AI agent system

Hugging Face, the platform hosting more than two million public AI models, disclosed a security incident on 16 July 2026 in which the attack was reportedly carried out entirely by an autonomous AI agent system. Over the course of a weekend, the attacker moved laterally through multiple internal clusters, generating more than 17,000 logged events in the process. It is one of the first documented cases in which an AI agent independently executed a cyberattack against production infrastructure.

To analyse the incident, Hugging Face deployed an AI model of its own: GLM 5.2, a Chinese open-weight model running on its own servers. This allowed the security team to complete in roughly one hour what would normally take days. Forensic investigation found that no public models, datasets or Spaces were compromised and that the software supply chain remained intact.

How the attack unfolded

The attack began with a malicious dataset that exploited two vulnerabilities in Hugging Face's data-processing pipeline. Through those vulnerabilities, the agent system established a foothold and then moved laterally across internal clusters. In total, the agent executed many thousands of individual actions, more than 17,000 of which were logged.

The specific language model on which the agent system was built has not been disclosed. According to the company, the system was presumably deployed from what is known as an agentic security-research harness, a framework that enables autonomous security researchers or attackers to execute complex sequences of actions without human intervention. The attacker chose a weekend as the timing, a common tactic to delay detection.

Hugging Face is working with external cybersecurity forensics specialists and has reported the incident to law enforcement. A follow-up investigation into the precise origin of the agent system is ongoing.

AI as a defensive tool, and the pitfall of safety filters

Hugging Face took an unusual defensive approach by deploying GLM 5.2 for forensic analysis. The open-weight model ran on the company's own infrastructure, enabling the team to search large volumes of log data quickly and identify patterns. Work that would normally require days of manual effort was completed within an hour.

During that forensic phase, however, an unexpected problem arose with commercial AI models. Their built-in safety filters proved unable to distinguish between exploit data within log files and actual attack instructions. As a result, those models refused to process certain log entries, slowing the investigation. The team switched to a model without those restrictions, which partly explains the choice of GLM 5.2. This side effect illustrates a tension that arises repeatedly in defensive AI use: safety measures designed to prevent misuse can also impede legitimate security research.

Damage and impact for users

The forensic investigation found that none of the platform's public, user-facing components had been tampered with. Models, datasets and the Spaces environment were examined and found to be unchanged. The software supply chain was also verified and found to be clean.

Hugging Face hosts more than two million public AI models and had more than 13 million users at the end of 2025, spread across more than 50,000 organisations. For all those users, the direct impact of this incident was limited to the company's internal infrastructure. The company has 250 employees and has raised a total of $400 million to date, including a Series D round of $235 million in August 2023 at a valuation of $4.5 billion.

The data-processing vulnerabilities exploited by the attacker have since been patched, the company said.

Broader implications for AI security

This incident demonstrates that autonomously operating AI agents are no longer merely a theoretical threat to digital infrastructure. The attack on Hugging Face is, as far as publicly documented, an early example of an agent independently executing a sustained attack chain against the production systems of a major AI platform.

For European and Dutch AI companies working with open model platforms, datasets or agentic pipelines, this is a concrete prompt to examine how vulnerable their own data-processing pipelines are to this type of automated attack. The finding that commercial AI models are rendered less useful for forensic work by their own safety filters also feeds into discussions about how those filters are configured and for which use cases they are or are not appropriate. Policymakers working on frameworks for AI use and cyber resilience, including under the EU AI Act and the revised NIS2 Directive, gain a more concrete picture from incidents like this of what autonomous AI systems in hostile hands can mean for the security of digital infrastructure.