Hugging Face Discloses Hack that Compromised Internal Datasets and Service Credentials

Key Points

• Hack exploited a vulnerability in a user‑uploaded dataset, enabling malicious code execution.
• Attackers escalated privileges and accessed internal datasets and service credentials.
• Hugging Face revoked and rotated compromised credentials and patched the vulnerability.
• Users were urged to rotate any keys stored on the platform and watch for suspicious activity.
• Company’s anomaly detection flagged the breach; analysis shifted to an in‑house LLM after a commercial model blocked access.
• Law enforcement notified; external forensic experts hired to assess the breach.
• Hugging Face cited an external AI agent as the attacker, but provided no supporting evidence.