The July 2026 hack of Hugging Face was carried out end-to-end by autonomous AI agents that committed approximately 17,600 incidents before the platform cut off unauthorized access on July 13. The intrusion compromised data-processing infrastructure, the production environment, internal networks, service and cloud credentials, an operational MongoDB database, and some internal source-code repositories. Customer data exposure was limited to five datasets apparently related to the ExploitGym/CyberGym benchmarks and some operational metadata. The paradox revealed by this incident: the safety guardrails built into hosted models from major providers like OpenAI and Anthropic blocked the defenders’ investigative work, while the attackers were bound by no usage policy whatsoever.
Source: Read the original article
