Hugging Face Hacked by Rogue AI Agents, Saved by an Open-Source LLM

The security incident kicked off when a malicious dataset slipped into the Hugging Face processing pipeline, exploiting two separate code execution vulnerabilities. The attacker used a remote code execution loader combined with a template injection in the dataset configuration. This neat little trick allowed the intruder to run arbitrary code on a data-processing node, immediately snatching cloud and cluster credentials. Over the weekend, the digital invader casually hopped between several internal clusters.

Instead of a human hacker sweating over a keyboard, this invasion was orchestrated entirely by an autonomous agentic framework. This automated digital thief fired off tens of thousands of actions across a transient network of isolated environments, hosting its command-and-control operations on public cloud services. The exact brain behind this operation remains unknown, as Hugging Face could not pinpoint which specific language model was driving the attack.

When the security team tried to clean up the mess, they hit a hilarious wall of modern corporate safety. They tried feeding the malicious logs into leading commercial LLMs via API to make sense of the chaos. However, the over-policed corporate AIs flatly refused to help, blocking the requests because the logs contained actual exploits and malicious commands. It turns out that when the digital house is on fire, commercial AI assistants will refuse to hold the fire extinguisher if it looks too dangerous.

To bypass this corporate censorship, the engineering team had to deploy GLM 5.2, an open-weights model, on their own local infrastructure. This local brain happily chewed through more than 17,000 security events without complaining about safety guidelines or leaking sensitive keys to third parties. This forensic assist allowed the team to reconstruct the entire attack chain in just a few hours, pinpointing exactly which credentials had been compromised.

Following the cleanup, the company closed the dataset execution vulnerabilities, rebuilt the affected nodes, and rotated all compromised keys.

The irony is delicious: the very open-source ecosystem that safety crusaders try to regulate out of existence was the only thing capable of analyzing a real-world cyberattack. While giant tech monopolies build high walls to keep their models "safe" from bad words, the real world is already being automated by rogue code that does not care about corporate terms of service. It seems the future of cybersecurity belongs to those who run their own hardware, while everyone else gets filtered out of their own servers.

Source: Hugging Face