AI versus AI: how Hugging Face detected and dissected the attack

The Hugging Face intrusion of July 2026 is one of the first documented cases of AI on both sides of an attack. Its disclosure says the attacker was an autonomous agent framework running many thousands of individual actions across a swarm of short-lived sandboxes, with command-and-control staged on public services. The defence, too, leaned on AI.

That combination is hard for traditional defences. When an attacker runs from a swarm of short-lived sandboxes and moves its command-and-control between public services, there is no single address to block for long. Indicators change faster than a human analyst can update a blocklist. What stays constant is behaviour: a processing worker reaching for credentials it never used before, or an internal machine talking to a service it has no reason to contact.

Detection: separating signal from noise

Hugging Face says the attack was first surfaced through AI-assisted detection. Its anomaly-detection pipeline uses LLM-based triage over security telemetry to separate real signals from the daily noise, and it was the correlation of those signals that flagged the compromise. That is the everyday problem of any security team: thousands of alerts, a few that matter. Using a language model to triage and correlate doesn’t replace detection rules; it helps humans see which alerts belong together.

Investigation: 17,000 events in hours

To understand what the swarm had done, Hugging Face ran LLM-driven analysis agents over the full attacker action log, which held more than 17,000 recorded events. It says this let the team reconstruct the timeline, extract indicators of compromise, map the credentials touched, and separate genuine impact from decoy activity, doing in hours what would usually take days, and matching the adversary’s speed.

Why decoys matter

An automated attacker can generate far more activity than it needs: probes that go nowhere, actions that look alarming but touch nothing of value. Whether deliberate or a side effect of trial and error, that noise costs defenders time. Every event has to be checked before an organisation can say with confidence what was, and was not, accessed. That statement is exactly what users, regulators and partners ask for after an incident, so the speed at which genuine impact is separated from noise directly shapes how quickly and honestly an organisation can disclose.

The asymmetry problem

One detail is especially useful for defenders. Hugging Face first tried frontier models behind commercial APIs. It says this did not work: the analysis required submitting large volumes of real attack commands, exploit payloads and command-and-control artifacts, and those requests were blocked by the providers’ safety guardrails, which cannot tell an incident responder from an attacker. The team ran the forensic analysis instead on an open-weight model on its own infrastructure, with a second benefit: no attacker data, and none of the credentials it referenced, left its environment.

Hugging Face’s practical lesson: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid being locked out by guardrails and to keep sensitive evidence in-house. The attacker, it notes, was bound by no usage policy.

OpenAI’s own account confirms the sequence: by the time its teams connected with Hugging Face, Hugging Face had already detected and stopped the activity and begun containment and forensic reconstruction with its own open-source models. Hugging Face also lists faster paging among its follow-up measures, a reminder that the best analysis only helps if the right people are woken up in time.

What this means for smaller teams

• Log first: AI can only analyse what was recorded. Keep network, authentication and process logs long enough to reconstruct an incident.
• Decide in advance which analysis tools you may use on sensitive incident data, and where that data is allowed to go.
• Keep a local, vetted model option for forensics, so evidence and credentials don’t leave your environment.
• Alert on behaviour, not only on known-bad addresses: new credentials in use, new destinations, unusual volumes.
• Keep humans in the loop: AI triage speeds up the reading, people still make the containment decisions.

The same “keep it local” principle is why FireAI runs its AI on the Mac: the connections it explains never leave the machine to be analysed.