Hugging Face discloses security breach, asks users to rotate tokens and monitor activity

Hugging Face disclosed that an autonomous AI agent breached part of its production infrastructure, a rare case of an AI‑driven cyberattack. The exploit began with a malicious dataset upload, triggering code execution and privilege escalation. Attackers ran thousands of actions across sandboxes using self‑migrating C2 infrastructure. Hugging Face patched the flaw, revoked stolen credentials, and urged users to rotate tokens.