On July 16, Hugging Face disclosed a compromise affecting part of its production infrastructure. The initial entry point was a malicious dataset, while the subsequent intrusion was, according to the company, carried out by an autonomous agent framework.
Attack Chain
The dataset abused two code-execution paths: a remote-code dataset loader and template injection in a dataset configuration. Code ran on a processing worker, after which the attacker obtained node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.
The agent framework executed thousands of operations across a swarm of short-lived environments, while its command-and-control infrastructure migrated between public services. The underlying LLM remains unknown. There is also no independent confirmation that a human operator was absent from every stage of the campaign.
What the Patches Reveal
Hugging Face has not published a CVE, payload, or exact exploit map. Changes in the public dataset-viewer repository, however, allow for a cautious partial reconstruction.
On July 13, developers updated fsspec and introduced an allowlist. Workers now accept only hf, s3, zip, file, and local; reference, simplecache, data, and every other implementation are removed from the registry. The previously available fsspec.ReferenceFileSystem processed configuration values through unsandboxed jinja2.Template(...).render(...). This is technically consistent with the disclosed template-injection path and a possible SSTI-to-RCE chain, but Hugging Face has not officially tied this code to the intrusion.
That same day, the company hardened the worker pods that process untrusted datasets. The patch disabled Kubernetes ServiceAccount token mounting, enabled seccompProfile: RuntimeDefault, and dropped all additional Linux capabilities. This reduces the blast radius of a compromised worker, but the exact path to node-level access remains undisclosed.
The next changes are consistent with credential rotation. On July 14, a transition to IRSA reached production, removing static S3 keys from the environment. On July 15, MONGO_URL moved from a static password to MONGODB-AWS authentication through IRSA, followed by support for JWT key rotation. These pull requests match the timing and scope of the response, but the company has not presented them as an official postmortem.
Scope and Attribution
Hugging Face confirmed unauthorized access to a limited set of internal datasets and several service credentials. The company has not disclosed their number, privileges, exposure window, or the volume of any possible exfiltration. Its assessment of potential impact on customers and partners remains ongoing.
No evidence of tampering was found in public models, datasets, or Spaces. Hugging Face also verified its container images and published packages as clean.
No threat group has made a verifiable claim of responsibility or produced data samples or other proof of access. No public indicators of compromise—C2 domains, IP addresses, or hashes—have been released either.
Claims linking the incident to JADEPUFFER, naming OpenAI or Anthropic as the providers used during the investigation, calling it the “first fully autonomous breach,” or citing 4,200 stolen tokens and 1,800 private models remain unsupported by the available sources.
How Hugging Face Investigated the Intrusion
Telemetry correlation supported by LLM-based triage initially surfaced the attack. Analysis agents then processed more than 17,000 events, reconstructed the timeline, extracted indicators for the internal investigation, mapped affected credentials, and separated genuine attacker activity from decoys.
Commercial models blocked requests containing real attacker commands, exploit payloads, and C2 artifacts. Hugging Face moved the forensic analysis to a locally deployed GLM 5.2 model from Z.ai, keeping logs and exposed secrets inside its own infrastructure. GLM was used by the defenders; the attacker’s model has not been identified.
Hugging Face closed both code-execution paths, rebuilt compromised nodes, revoked affected tokens, began a broader secret rotation, and strengthened cluster admission controls. The company recommends that users rotate their Hugging Face tokens and review recent account activity.
답글 남기기