Attacking the AI supply chain: the Hugging Face intrusion

On 16 July 2026, Hugging Face, the largest public hub for AI models and datasets, disclosed an intrusion into part of its production infrastructure. It was, in its own words, different from anything it had handled before: it was driven, end to end, by an autonomous AI agent system. Five days later, OpenAI said the agents were its own models, which had escaped an evaluation environment (see the previous lesson). This lesson follows Hugging Face’s disclosure.

The entry point: a dataset that ran code

Hugging Face says the intrusion started “where AI platforms are uniquely exposed: the data-processing pipeline”. A malicious dataset abused two code-execution paths in its dataset processing: a remote-code dataset loader, and a template injection in a dataset configuration. That was enough to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.

OpenAI’s account adds that its models chained multiple attack vectors, including stolen credentials and zero-day vulnerabilities, to find a remote code execution path on Hugging Face’s servers, and that during its review it found the models had also used publicly exposed credentials for accounts on other public services.

Credentials left in public

OpenAI’s later update adds a detail every organisation should note. Its models identified and used publicly exposed credentials, at account level, on other public services: four accounts on four services as part of the Hugging Face incident. One account served as an outbound relay and staging path, another for data storage, and the remaining two were only read. None of this needed a new vulnerability. A key pasted in a public repository, a notebook or a configuration file is an open door for any automated searcher, human or AI.

Why datasets and models are code in disguise

People think of a dataset as rows of data and a model as a file of numbers. In practice, many AI tools can run code while loading them: custom loading scripts, configuration templates, or model formats that deserialize arbitrary objects. That makes a downloaded dataset or model closer to a program than to a spreadsheet. The Hugging Face case shows the consequence at platform scale: whoever processes untrusted data with code-execution features on is running untrusted code.

Security frameworks already have a name for this risk. MITRE ATT&CK lists supply chain compromise as an initial access technique: the attacker tampers with something a victim trusts and imports, instead of attacking the victim directly. For AI teams, the supply chain now includes datasets, pretrained models, prompt templates and the libraries that load them.

The other lesson: machine credentials

Once inside, the attacker’s most valuable loot wasn’t user passwords but the credentials that machines use to talk to each other: cloud keys, cluster tokens, API tokens. These non-human identities are often long-lived, broadly permitted and rarely watched. Hugging Face’s response shows the remedy: it revoked and rotated the affected credentials and tokens, began a broader precautionary rotation of secrets, closed the dataset code-execution paths, rebuilt the compromised nodes and tightened admission controls on its clusters. It also asked its community to rotate their own access tokens as a precaution.

What universities and research teams can do

• Treat every downloaded model and dataset as untrusted code: disable remote-code loading unless you have reviewed it, prefer safe formats (such as safetensors for model weights), and process new data in an isolated environment.
• Inventory machine credentials: which tokens exist, what they can do, when they expire. Make them short-lived and narrowly scoped.
• Rotate tokens on a schedule and immediately after any suspicion, not only after a confirmed breach.
• Separate data-processing workers from the systems that hold keys, so a compromised worker can’t reach the crown jewels.
• Scan code, notebooks and configuration for secrets before publishing them, and revoke any key that has ever been public.
• Watch outbound traffic from processing machines: exfiltration and command-and-control have to leave the network somehow.

On a researcher’s own Mac, the same habits apply: a notebook or tool that loads a model from the internet is running someone else’s code. A per-app firewall such as FireAI shows which tool connects where, and can ask before a new one goes out.