An autonomous AI agent hacked Hugging Face — and the company used AI to stop it

hugging face revealed a security intrusion where an autonomous ai agent framework breached its production infrastructure through a malicious dataset that exploited code-execution vulnerabilities. the attack, which involved lateral movement and credential harvesting across multiple clusters, was detected by an llm-based triage system and analyzed by running ai agents over 17,000 log events to reconstruct the timeline. while no public models or supply chain tools were tampered with, the company noted that analyzing the attack was constrained by commercial api safety filters blocking exploit data. hugging face has since closed the vulnerabilities, rotated credentials, and deployed stricter guardrails, marking the industry's first major end-to-end autonomous ai-on-ai attack scenario.