End-to-end autonomously-conducted cyberattack uses malicious inputs, privilege escalation, credential theft, lateral movement, and adaptive ephemeral infrastructure.
Open source AI ecosystem Hugging Face has disclosed that an autonomous AI agent was responsible for breaching its systems in what is being described as a first-of-its-kind incident involving end-to-end AI-driven intrusion activity.
According to the firm, the attack had taken place over a single weekend in mid-July, and leveraged vulnerabilities in its dataset processing infrastructure to gain a foothold.
The official disclosure frames the event as an early real-world example of “agentic” threat models long theorized in cybersecurity research but not previously observed at this scale in production environments.
Forensic trail of the attack
The breach began when the attacker introduced a malicious dataset that exploited two separate weaknesses: a remote code execution flaw in the dataset loader, and a template injection issue in dataset configuration. Once execution was achieved within a processing environment:
- The agent escalated privileges to gain control at the node level
- From there, it extracted credentials associated with cloud and cluster operations and proceeded to move laterally across internal systems.
- The attacker’s infrastructure dynamically shifted across public services, complicating detection and response efforts.
What distinguishes this incident is not only the technical pathway, but the operational model. The firm said the AI-driven system carried out thousands of discrete actions across ephemeral compute environments, effectively automating reconnaissance, exploitation, and post-compromise activity.
As a workaround, the team had to turn to an open-weight model, GLM-5.2, running internally, which allowed unrestricted analysis without exposing sensitive data externally.
Aftermath details
The firm has since remediated the exploited vulnerabilities, rebuilt affected infrastructure, rotated compromised credentials, and implemented tighter controls across its clusters. External forensic experts have been engaged, and law enforcement has been notified. Although it continues to assess whether any customer or partner data may have been impacted, there has so far not been any evidence of criminal tampering with publicly hosted models, datasets, or its software supply chain. Users have been advised to rotate access tokens and review account activity as a precaution.
