Hugging Face platform hit by cyberattack: User data at risk

Hugging Face, one of the world's largest platforms for storing and developing AI models, has officially confirmed it was hit by a cyberattack. According to the company, hackers managed to gain access to the platform's internal systems, obtaining sensitive datasets and service keys. This incident once again highlights the critical importance of security in the AI ecosystem. This is reported by Techcrunch.com reports .

The Hugging Face administration is investigating the breach that occurred last week. It appears the attack was carried out via malicious datasets uploaded to the platform. Hackers exploited a vulnerability in the security system to execute malicious code on servers, escalating their privileges to gain access to internal systems.

Security measures and recommendations for users

According to TechCrunch, the company has revoked and rotated all compromised authentication keys. Nevertheless, Hugging Face is asking all users to immediately rotate their access tokens and review their profiles for suspicious activity. The extent of the impact on customer or partner personal data is currently being determined.

The company blames an external AI agent for the attack. It is noted that thousands of individual actions were performed during the attack, coordinated through short-lived sandboxes and control centers in public services. However, Hugging Face has not yet provided sufficient evidence regarding this complex attack method.

AI models and cybersecurity barriers

Interestingly, during the attack analysis, Hugging Face encountered an unexpected problem. The company initially wanted to use a large commercial AI model, but the analysis was halted due to the provider's security guardrails. It turns out that many modern models block cybersecurity-related queries, even when intended for defensive purposes.

As a result, the company was forced to use its own local Large Language Model (LLM). This method not only allowed the analysis to be completed but also ensured that sensitive attack logs were not uploaded to third-party servers. This situation has once again highlighted the tensions between cybersecurity researchers and model creators like Anthropic.

Hugging Face has announced that the vulnerability that caused the cyberattack has been patched. Experts emphasize that AI platforms must protect themselves not only from traditional hacking attacks but also from complex cyber-threats executed using AI tools themselves. Users and developers are advised to check their data on the platform.