MisuseSerious5 sourcesFirst seen
The Robot Broke In, Then Did the Paperwork: Hugging Face Hit by an Autonomous AI Agent
Ourtake
Attackers needed no human at the keyboard for most of this one. Defenders still needed a model that would look at the logs.
What happened
Hugging Face disclosed an intrusion that it says was driven end to end by an autonomous AI agent. The agent gained host access, harvested cloud and cluster credentials, and moved laterally across internal clusters, leaving an action log of more than 17,000 events. Hugging Face fixed the root cause and rebuilt affected systems, and an external forensic investigation is ongoing.
Sources
- embracethered.com · Autonomous AI Intrusions Are Here: Lessons from the Hugging Face Compromise (opens in a new tab)
- sophos.com · When the attacker is an AI agent (opens in a new tab)
- hiddenlayer.com · Hugging Face AI Agent Attack: What the Artifacts Reveal (opens in a new tab)
- manifold.security · AI agents have few qualms with log tampering (opens in a new tab)
- sciencenews.org · When AI goes rogue, its human overseers may be to blame (opens in a new tab)