Hugging Face Discloses AI-Agent-Driven Breach, Used GLM 5.2 for Forensics After Guardrails Blocked Commercial Models
An autonomous attacker system exploited two code-execution flaws in Hugging Face's dataset pipeline and generated over 17,000 logged actions before being contained; investigators switched to the open-weight GLM 5.2, run locally, after commercial model providers' safety filters blocked forensic queries containing real exploit payloads.
Hugging Face disclosed that a breach detected earlier this week was carried out end to end by an autonomous AI agent system, which used a remote-code dataset loader and a template-injection flaw in a dataset configuration to gain a foothold on a processing worker, then escalated privileges and harvested cloud and cluster credentials across internal infrastructure.
- Attacker logged over 17,000 individual actions across a swarm of short-lived sandboxes
- Compromised: a limited set of internal datasets and several service credentials
- Not compromised: public models, public datasets, Spaces, and the software supply chain
- Investigators processed the attacker logs with LLM-driven forensic agents to reconstruct the timeline
The disclosure's most notable detail for practitioners: commercial hosted models refused to help with the forensic analysis. Hugging Face said it switched to the open-weight GLM 5.2, run on internal infrastructure, after safety guardrails on commercial APIs blocked submissions containing real attack commands, exploit payloads and C2 artifacts.
These requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker - Hugging Face security incident disclosure
Running the analysis locally on an open-weight model had a second benefit the company noted: no attacker data or referenced credentials ever left its own environment. Hugging Face has rotated affected credentials and rebuilt the compromised nodes.