Home / Technology / Hugging Face Hit by First-Known AI-on-AI Cybercrime
Hugging Face Hit by First-Known AI-on-AI Cybercrime
20 Jul
Summary
- An autonomous AI agent system launched a cyberattack against Hugging Face.
- Hugging Face used its own AI to detect and analyze the unprecedented attack.
- The company fixed vulnerabilities and is investigating potential data impact.
Hugging Face has disclosed an unprecedented cyberattack, apparently the first instance of AI-on-AI cybercrime targeting a major AI platform. The incident involved an autonomous AI agent system that exploited two vulnerabilities in Hugging Face's data-processing pipeline.
This breach allowed the attacker to gain node-level access and traverse internal clusters using compromised credentials. Hugging Face employed its own AI tools to investigate the sophisticated attack, which involved thousands of actions executed by the autonomous agent.
Investigating the breach was complicated by the safeguards on commercial AI models, which blocked forensic analysis requests. Hugging Face ultimately used an open-weight Chinese model to analyze over 17,000 events in an hour.
The company has since remediated the exploited vulnerabilities, secured its infrastructure, and revoked exposed credentials. Hugging Face is still determining if customer or partner data was affected and has urged users to review their accounts and rotate tokens.
