Hugging Face, a prominent platform for hosting AI models and datasets, recently disclosed a security breach that compromised internal datasets and service credentials. The company is currently investigating whether any customer or partner data was affected during the incident.
The breach originated from a dataset uploaded to Hugging Face’s platform, which exploited a security vulnerability to execute malicious code on the company’s servers. This allowed the attackers to escalate their permissions and gain broader access to internal systems. In response, Hugging Face has revoked and rotated the compromised credentials and urged users to do the same with any keys stored on the platform. Users are also advised to review their accounts for any suspicious activity.
To address the exploited vulnerability, Hugging Face has implemented a fix and reported the incident to law enforcement. The company is collaborating with cybersecurity forensic specialists to investigate the breach and enhance its security measures.
Notably, Hugging Face attributed the breach to an external AI agent that executed numerous actions across multiple short-lived sandboxes, utilizing public services for command-and-control operations. The company’s anomaly detection systems identified the attack, and an AI model was employed to analyze server logs documenting the cyberattack.
Initially, Hugging Face used a frontier AI model from a commercial provider for analysis. However, the effort was hindered by the provider’s guardrails, leading the company to utilize its own local large language model. This approach had the added benefit of keeping sensitive attack logs within the company’s infrastructure.
This incident underscores the evolving nature of cyber threats, particularly the use of autonomous AI agents in executing sophisticated attacks. It highlights the importance of robust security measures and the need for continuous monitoring and rapid response to potential vulnerabilities. Organizations must remain vigilant and proactive in safeguarding their systems against such advanced threats.
