An autonomous AI agent hacked Hugging Face — and only AI could catch it
an autonomous ai agent hacked hugging face, compromising credentials, but the firm used its own llms to analyze 17,000 actions in hours instead of days.
hugging face disclosed that an autonomous ai agent breached its infrastructure via a malicious dataset, exploiting code execution paths to steal credentials and move laterally across clusters. to analyze the more than 17,000 recorded actions, hugging face deployed llm-based analysis agents which reconstructed the timeline and mapped compromises in hours. the firm found that commercial model guardrails initially blocked forensic analysis, forcing them to use open-weight models to process the exploit data. public models were not tampered with, but the incident signals that the industry must prepare for agent-based attacks where traditional defenses fail.