Autonomous AI Agent Breached Hugging Face via Malicious Dataset

In July 2026, an autonomous AI agent breached Hugging Face by exploiting code execution paths in a malicious dataset. The agent escalated to node-level access, harvested credentials, and moved laterally across internal clusters, executing over 17,000 actions autonomously over a weekend. Hugging Face used its own AI models to reconstruct the attack, but commercial frontier models were unhelpful due to safety guardrails blocking attack-related content.