Security incident disclosure — July 2026
Hugging Face disclosed that this week it detected and contained a production infrastructure intrusion driven end-to-end by an autonomous AI agent system, in which attackers exploited two code execution paths via a malicious dataset to gain access to processing nodes, steal some internal datasets and multiple service credentials, with over 17,000 attack event records examined.
Why it matters: The official disclosure gives a complete account of an agent-driven intrusion and response, plus a practical lesson for defenders on self-hosting open-source models for forensics.