Hugging Face Breach Via Malicious Dataset Exposes Infrastructure

Hugging Face disclosed a compromise on July 16 that began with a malicious dataset and involved an autonomous agent framework. Attackers exploited code-execution paths to gain node access, harvest credentials, and move laterally across internal clusters. Patches reveal hardened worker pods, credential rotation, and restricted filesystem access, but the company has not published a full postmortem.