Hugging Face confirms breach affected internal datasets and credentials, urges users to take action - TechCrunch

What the report says

TechCrunch reports that Hugging Face, the AI model and dataset hosting platform, disclosed a security breach in which internal datasets and service credentials were compromised. The company said the incident occurred the prior week and was disclosed Friday, while its investigation into whether customer or partner data was taken was still ongoing.

According to the company’s blog post cited by TechCrunch, attackers used a dataset uploaded to the platform to exploit a security flaw and execute malicious code on Hugging Face servers. That access allegedly allowed them to increase permissions and reach more internal systems. Hugging Face said it has fixed the abused vulnerability and revoked or rotated credentials that were exposed.

The company is advising users to rotate any access tokens or keys stored on Hugging Face and to check their accounts for unusual activity. Hugging Face also said its anomaly detection systems identified the attack, and that it used a local large language model to help analyze server logs rather than sending sensitive logs to an outside AI provider. TechCrunch noted that Hugging Face attributed the intrusion to an external AI agent, but said the company did not immediately provide evidence for that claim when asked.

Hugging Face said it has contacted law enforcement and brought in cybersecurity forensics specialists to investigate and review its defenses. The incident matters because Hugging Face is widely used in the AI ecosystem to share and host models, datasets and related development resources, making credentials and internal access especially sensitive if abused.