An AI Agent Breached Hugging Face. Another AI Caught It. Here’s What You Need to Do.

In July 2026, Hugging Face disclosed a breach by an autonomous AI agent. The attacker exploited a malicious dataset via a remote code dataset loader and template injection to run code on a processing worker. The agent escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across internal clusters. Over one weekend, it performed 17,000 actions without human intervention. Users are advised to rotate tokens and audit remote code execution flags immediately.