核心要点
- 热门 AI 平台 Hugging Face 遭遇网络攻击，据报道该攻击完全由一个自主 AI 智能体系统实施。
- 攻击者以恶意数据集为切入点，借此入侵内部数据并窃取了该平台的登录凭证。
- 为分析攻击者留下的超过 17,000 条操作记录，Hugging Face 部署了自身 AI 工具，在短短几小时内而非数天内完成了完整的取证分析。
AI 平台 Hugging Face 披露其部分生产基础设施遭到入侵，据称该入侵完全由一个自主 AI 智能体系统实施。该公司表示，其很大程度上利用自身 AI 工具检测并分析了此次攻击。
据 Hugging Face 称，攻击者未经授权访问了少量内部数据集以及 Hugging Face 服务使用的若干凭证。该公司表示，公开的模型、数据集和 Spaces 未被篡改，软件供应链也未受影响。合作伙伴或客户数据是否遭到泄露仍在调查中。
一个恶意数据集打开了大门
据 Hugging Face 称，攻击始于任何 AI 平台最薄弱的环节之一：数据处理管道。一个恶意数据集利用了数据集处理中的两条代码执行路径，具体来说是数据集加载器中的远程代码执行和数据集配置中的模板注入。
攻击者由此提升至节点级别，收集了云和集群凭证，并在一个周末内横向移动至多个内部集群。该公司表示，一个基于智能体安全研究框架构建的自主智能体框架策划了整个攻击行动。
Hugging Face 表示尚不清楚是哪个语言模型驱动了此次攻击。该系统通过一群短暂存在的沙盒执行了成千上万次独立操作，并使用了运行在公共服务上的自迁移命令与控制基础设施。该公司将此次事件归类为业界一段时间以来一直预测的“智能体攻击者”场景。
AI 驱动的分析将调查时间从数天缩短至数小时
Hugging Face 表示，他们通过一个基于 AI 的异常检测管道发现了此次攻击，该管道利用大语言模型对安全遥测数据进行分类处理。为了理解超过 17,000 条记录的攻击者行为，该公司部署了由大语言模型驱动的分析智能体。
这些智能体重建了攻击时间线，提取了入侵指标，映射了受影响的凭证，并将实际损害与欺骗性活动区分开来。该公司表示，原本需要数天完成的工作在数小时内就完成了。
商业 AI 安全过滤器反而阻碍了公司自身的防御
据 Hugging Face 称，当安全团队首次尝试使用商业 API 背后的前沿模型分析攻击日志时，他们碰了壁。这些提供商的护栏机制阻止了请求，因为它们无法区分事件响应人员和攻击者。分析需要提交大量真实的攻击命令、漏洞利用载荷和 C2 工件，所有这些都触发了过滤器。
该公司转而使用在其自有基础设施上运行的开源权重模型 GLM 5.2。据该公司称，这有两个优势：没有攻击者数据，并且所有引用的凭证从未离开过其自身环境。
Hugging Face 写道：“我们不知道攻击者的智能体使用了哪个模型，是越狱的托管模型还是不受限制的开源权重模型；无论哪种方式，攻击者都不受任何使用政策的约束，而我们自己的取证工作却被我们最初尝试的托管模型的护栏所阻碍。”
该公司表示，对防御者而言，实际教训是在事件发生前，就在自己的基础设施上部署一个能力强大的模型。Hugging Face 补充说，这并非反对在托管模型上实施安全措施。
Hugging Face 的回应与待解问题
Hugging Face 表示，已关闭被利用的代码执行路径，撤销了攻击者的访问权限，重建了受感染的节点，并轮换了受影响的凭证。该公司还加强了访问控制并改进了检测系统，据博客文章称。Hugging Face 正与外部网络安全取证专家合作，并已向执法部门报告此事。作为预防措施，该公司建议所有用户轮换其访问令牌并检查近期账户活动。
该事件证实，自主的、由 AI 驱动的攻击工具已不再是理论上的存在。据 Hugging Face 称，它们降低了大规模、多阶段攻击的成本，并以机器速度运行。该公司认为，数据和模型面应被视为一级攻击面，而防御方也需要拥有自己的 AI 才能跟上节奏。
Hugging Face 指出，商业安全过滤器竟能阻止其自身的取证工作，这是行业应为之做好准备的一个漏洞。但该公司同时也是最大的开源 AI 模型平台之一，并且将开放模型定位为安全工作中不可或缺的一部分，这显然符合其商业利益——因此，其关于防御方绝对需要手头拥有自己的开放权重模型的结论，并非完全无私。
Key Points
- Hugging Face, the popular AI platform, was hit by a cyberattack that was reportedly carried out entirely by an autonomous AI agent system.
- The attackers used a malicious dataset as their entry point, which allowed them to compromise internal data and steal login credentials from the platform.
- To analyze the more than 17,000 recorded actions taken by the attacker, Hugging Face deployed its own AI tools, completing the full forensic analysis in just a few hours instead of days.
AI platform Hugging Face has disclosed a breach of parts of its production infrastructure that was allegedly carried out entirely by an autonomous AI agent system. The company says it detected and analyzed the attack largely with its own AI tools.
According to Hugging Face, the attackers gained unauthorized access to a limited set of internal datasets and several credentials used by Hugging Face services. The company says public models, datasets, and Spaces were not tampered with, and the software supply chain was not affected. Whether partner or customer data was compromised is still under investigation.
A malicious dataset opened the door
According to Hugging Face, the attack started at one of the weakest spots on any AI platform: the data processing pipeline. A malicious dataset exploited two code execution paths in dataset processing, specifically a remote code dataset loader and a template injection in a dataset configuration.
From there, the attacker escalated to node level, harvested cloud and cluster credentials, and moved laterally across multiple internal clusters over a weekend. An autonomous agent framework built on an agentic security research harness orchestrated the entire campaign, the company says.
Hugging Face says it doesn't know which language model powered the attack. The system executed many thousands of individual actions through a swarm of short-lived sandboxes and used self-migrating command-and-control infrastructure running on public services. The company classifies the incident as the "agentic attacker" scenario the industry has been predicting for some time.
AI-powered analysis cut investigation time from days to hours
Hugging Face says it spotted the attack through an AI-powered anomaly detection pipeline that runs LLM-based triage on security telemetry. To make sense of the more than 17,000 recorded attacker actions, the company deployed LLM-driven analysis agents.
Those agents reconstructed the timeline, extracted indicators of compromise, mapped affected credentials, and separated real damage from deception activity. Work that would normally have taken days was done in hours, the company says.
Commercial AI safety filters blocked the company's own defense
According to Hugging Face, when the security team first tried to analyze the attack logs using frontier models behind commercial APIs, it hit a wall. The providers' safety guardrails blocked the requests because they couldn't tell an incident responder from an attacker. The analysis required submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, all of which tripped the filters.
The company turned to the open-weight model GLM 5.2, running on its own infrastructure. According to the company, that had two advantages: no attacker data, and none of the referenced credentials ever left its own environment.
"We do not know which model powered the attacker's agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried," Hugging Face wrote.
The practical lesson for defenders, the company says, is to have a capable model running on your own infrastructure before an incident happens. Hugging Face adds that this isn't an argument against safety measures on hosted models.
Hugging Face's response and open questions
Hugging Face says it shut down the exploited code execution paths, revoked the attacker's access, rebuilt compromised nodes, and rotated affected credentials. The company also tightened access controls and improved its detection systems, according to the blog post. Hugging Face is working with external cybersecurity forensics experts and has reported the incident to law enforcement. As a precaution, the company recommends that all users rotate their access tokens and review recent account activity.
The incident confirms that autonomous, AI-driven attack tools are no longer theoretical. According to Hugging Face, they lower the cost of broad, multi-stage campaigns and operate at machine speed. The company argues that data and model surfaces need to be treated as first-class attack surfaces and that defenders need AI of their own to keep pace.
Hugging Face calls the fact that commercial safety filters blocked its own forensic work a gap the industry should prepare for. But the company is also one of the largest platforms for open-source AI models and has a clear business interest in framing open models as indispensable for security work, so its conclusion that defenders absolutely need their own open-weight models on hand isn't entirely selfless.