Security incident disclosure — July 2026

Hugging Face disclosed that this week it detected and contained a production infrastructure intrusion driven end-to-end by an autonomous AI agent system, in which attackers exploited two code execution paths via a malicious dataset to gain access to processing nodes, steal some internal datasets and multiple service credentials, with over 17,000 attack event records examined.