AI Agent Behind Hugging Face Breach Signals a New Kind of Intruder

Hugging Face has disclosed an intrusion that, according to the company, was carried out end to end by an autonomous AI agent system. The attacker gained a foothold through a malicious dataset and two code-execution paths in the company's dataset processing pipeline: a remote-code dataset loader and template injection in a dataset configuration. Hugging Face did not publish exact exploit details. The agent then gained host-level access, harvested cloud and cluster credentials, and moved into several internal clusters. It carried out tens of thousands of automated actions across short-lived sandboxes, leaving more than 17,000 recorded events. Hugging Face's own LLM-based anomaly detection flagged the activity first. Separately, Sysdig has published research on JADEPUFFER, which it assesses to be agent-driven ransomware that adapts in real time.

The company fixed the root cause, removed the attacker's foothold and rebuilt affected systems. It recommends that users rotate credentials and review activity on their accounts. The source does not yet say which AI model the attacker used, only that the agent appears to be built on an open-source research agent.

One notable lesson came during the investigation. Hugging Face first tried commercial frontier models to analyse the attacker's commands, payloads and credentials, but provider safety guardrails repeatedly blocked the forensic work. The team switched to GLM 5.2, an open-weight model, running on its own infrastructure. This let analysis continue and kept attacker data and credentials inside Hugging Face's environment. The analysis reconstructed the timeline and produced indicators of compromise.