The IT Nerd

Open-source AI and machine learning platform Hugging Face said it detected and responded to an intrusion into part of its production infrastructure. They said it was different from anything they had previously handled in that it was driven end to end, by an autonomous AI agent system that accessed to a limited set of internal datasets and to several credentials used by their services,

Hugging Face has posted details here: https://huggingface.co/blog/security-incident-july-2026

Rohit Valia, CEO of cybersecurity company Tumeryk, provided the following comments: 

“Open source model repositories like Hugging Face now represent a meaningful supply chain risk. As adversaries increasingly target training and fine-tuning data rather than source code, organizations need to test open source models for behavioral drift, not just code-level vulnerabilities. An AI trust score gives enterprises a way to verify a model hasn’t been altered and is safe to use, while aligning to frameworks like the Cloud Security Alliances RiskRubric v2 which provide the structured testing methodology.”

If you use Hugging Face, you might want to see if you are at risk. And you might want to do it sooner rather than later.

UPDATE: Two more comments came in staring with Gidi Cohen, CEO & Co-Founder, Bonfy.AI:

“This incident should be a wake-up call, not because AI was involved, but because it shows how fast AI-native attacks are outpacing security programs.

An autonomous agent didn’t use fancy tricks, it just exploited familiar gaps in the system like code execution paths, credentials, and lateral movement. The difference is speed. Thousands of coordinated actions across short-lived environments shrank the response window from days to hours.

The bigger issue is defense. Hugging Face found its own response constrained by model guardrails. This s a new imbalance we see everywhere: the attacker operates without limits, while defenders (security personnel or security platforms) rely on tools that can refuse to help. If your company’s response tech stack isn’t fully under your control, your security posture isn’t either.

From this case, we have three takeaways for leaders: 1) “Data as code” is now a real attack surface. 2) Speed is the new risk multiplier. 3) You need internal, controllable AI for incident response, not just external APIs.

Security is shifting from hardening systems to operating at the speed of agents with tools you own. Organizations that plan for both sides of AI (attacker and defender) will set a new baseline for resilience.”

Toghrul Tahirov, Head of AI Governance,  Polygraf AI

“What stands out to me in this Hugging Face incident is that the attack reportedly began with something organizations routinely trust: data entering an AI processing pipeline. Once AI agents can execute code and access infrastructure, a malicious dataset is no longer just bad content. It can become an entry point for credential theft and lateral movement. This is a reminder that AI systems must be treated as privileged software, not as just a smarter generation of the chatbots we’re used to.

My professional opinion is that secure AI adoption requires controls around the entire interaction: inspect untrusted data, isolate execution, minimize permissions, use short-lived credentials, restrict network access, and maintain clear audit trails. Organizations also need incident-response tools they can operate privately without exposing sensitive evidence. The answer is not to avoid AI agents, but to ensure governance and security ar

UPDATE #2: More commentary starting with John Strand, Owner, Black Hills Information Security, Inc.: 

“There are plenty of jokes to be made about autonomous AI agents attacking a website that hosts autonomous AI agents, but that’s not the part that concerns me. What caught my attention was the claim that everything had been verified as clean despite hosting more than 45,000 models. At that scale, what does ‘verified clean’ really mean? Validating tens of thousands of models is an enormous challenge. That’s the reality we’re going to keep running into with software supply chain attacks. Whether it’s Hugging Face or any other platform hosting code that developers depend on, proving that everything is truly clean is only going to get harder as these ecosystems continue to grow.” 

Donald McFarlane, Advisory Board Member, Xcape, Inc. 

“This incident underscores how AI is changing the economics of cyber offense. AI-enabled tools allow attackers to automate reconnaissance, accelerate exploitation, and operate at machine speed. Just as leaders who eschewed advances such as longbows, RADAR, or drones have repeatedly found themselves facing defeat, defenders cannot afford to ignore AI. We must leverage AI to modernize cyber defense so as to increase attackers’ costs while reducing defenders’ workload. Meanwhile, organizations continue to need strong identity controls, segmentation, containment and resilience. 

“Although Hugging Face reports no evidence that public models or the software supply chain were modified, incidents like this highlight the importance of protecting not only infrastructure, but also the credentials, private repositories, datasets, and deployment pipelines that support modern AI development.” 

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs: 

“Dataset processing pipelines get the same level of security scrutiny that CI/CD hooks and build functions get, which is almost none. Teams pour AppSec effort into the application layer and treat the infrastructure that ingests and transforms data as plumbing. The attacker exploited a remote code loader and a template injection in that plumbing, then let an autonomous agent framework chain them across 17,000 actions in a weekend. 

“A human attacker running that campaign needs a team and weeks. The agent framework did it with short-lived sandboxes and command-and-control staged on public services. Keeping pace requires AI-assisted incident response, and Hugging Face found out what happens when you reach for it mid-breach. 

“Hugging Face’s team fed attack logs to commercial frontier models, and safety filters blocked the analysis because the logs contained real exploit payloads. They ran GLM 5.2, an open-weight model, on their own infrastructure instead. I’ve hit the same wall. I still run Opus 4.6 for security work and haven’t upgraded because newer models’ guardrails increasingly block legitimate analysis of exploit code and attack artifacts. 

“Machine-speed exploitation requires machine-speed response, and that response can’t run on models that refuse to examine the evidence.” 

Waseem Ahmed, Head of Engineering, Secure.com:

   “For years we talked about the agentic attacker as a someday problem. Hugging Face just made it today’s problem. One agent, no human at the keyboard, credentials stolen and infrastructure crossed in a single weekend.

   “The response is as telling as the attack. Hugging Face used AI to reconstruct the full attacker timeline in hours rather than days — processing thousands of events that would have taken a human team far longer to sequence. AI ran the attack. AI ran the investigation. That is the new baseline.

   “The part that should concern every security team: you cannot out-click an attacker operating at machine speed across 45,000 models and 50,000 customer environments. The only viable answer is defence that runs at the same speed and never clocks out — AI that watches, triages, and acts alongside your team every hour of every day.

   “Fight autonomous attacks with autonomous defence, or you will always be a step behind.”