An AI Bot Broke Into Hugging Face. Hugging Face Used AI to Catch It.

Key points

• Hugging Face, a major platform for sharing AI models and datasets, confirmed an intrusion into part of its production infrastructure in July 2026.
• The attack was run end-to-end by an autonomous AI agent, software that planned its own steps and executed them without a human directing each one.
• Hugging Face's security team used its own AI tools to analyse more than 17,000 recorded attacker actions, compressing days of forensic work into hours.
• Mainstream commercial AI models blocked the defenders' forensic queries due to safety filters, forcing the team onto a self-hosted open model called GLM 5.2.
• Hugging Face found no evidence that its public-facing models or datasets were tampered with, but it is still checking whether partner or customer data was exposed.

Something quietly significant happened at one of the internet's biggest AI hubs last weekend. Hugging Face, the platform where researchers and companies share AI models and datasets, posted a security disclosure this week confirming it had been broken into. Not by a person sitting at a keyboard. By an autonomous AI agent that set its own goals, wrote its own next steps, and kept going for days without human input.

The entry point was the data-processing pipeline, the automated system that ingests datasets uploaded by users. Two weaknesses there let the attacker's code trick the system into running malicious instructions. From that foothold, the agent escalated its own access privileges, harvested login credentials for cloud services, and moved quietly across several internal clusters over a full weekend.

The company estimates tens of thousands of individual automated actions were executed. That is not a typo.

Should Hugging Face users be worried?

For most users the immediate risk is low, but the platform is asking everyone to rotate their API tokens, the personal keys that grant access to your Hugging Face account, as a precaution. Think of it like changing your locks after a neighbour's house was burgled: probably unnecessary, but cheap insurance. Log in, generate a fresh token, revoke the old one. Anyone whose data was directly affected will be contacted by Hugging Face directly.

The forensic work that unpicked the attack is worth pausing on. Using their own AI analysis tools, the security team processed a log of over 17,000 recorded events and reconstructed exactly what the agent did. Hours instead of days. It's the kind of turnaround that simply wasn't possible before AI-assisted analysis existed.

But there was a catch nobody had planned for.

When the team fed raw attack data into frontier commercial AI models via their APIs, those models refused to help. Safety filters built into services from providers like OpenAI and Anthropic can't tell the difference between a forensic analyst studying an attack and a criminal planning one, so the requests were blocked. Hugging Face switched to GLM 5.2, an open-weight model whose underlying code is publicly available and can be run on your own hardware. Running it internally kept all sensitive attacker data inside their own walls, and none of it leaked to a third-party cloud during the investigation.

Hugging Face is sharing this feedback with the commercial providers concerned and isn't arguing those safety measures are wrong. The practical lesson for any security team: have a capable model you can run privately and have it vetted before an incident forces the question.

This is the first AI-intrusion case we've covered at AI2Day, though our reporting on the Forg365 phishing kit showed just last month how AI is already weaponised at the access layer. The Hugging Face case goes further: the attacker wasn't assisted by AI, it was AI, operating at machine speed, at low cost, with no fatigue.

Defenders now need AI running at the same pace. That's the uncomfortable shift this incident makes concrete, and it won't be the last time we report it.