Autonomous AI Intrusions Are Here: Lessons from the Hugging Face Compromise · Embrace The Red

Hugging Face disclosed an intrusion that, according to them, was driven end to end by an autonomous AI agent system.

Along similar lines, Sysdig recently published a blog on JADEPUFFER, which it assesses to be an agent-driven ransomware capable of adapting in real time. The report does not identify the victim or fully explain how Sysdig obtained visibility into the operation.

The Hugging Face disclosure highlights three important things: autonomous AI intrusion, defensive asymmetry, and missing IOCs.

The Hugging Face Intrusion

The beachhead was established through a malicious dataset and two code-execution paths in their processing pipeline: a remote-code dataset loader and template injection in a dataset configuration. Hugging Face did not publish exact exploit details though.

Afterwards the agent gained node-level (host) access, harvested cloud and cluster credentials, and moved laterally into several internal clusters. The framework executed tens of thousands of automated actions across short-lived sandboxes, leaving an attacker action log of more than 17,000 recorded events. Pretty wild.

Their anomaly-detection pipeline (LLM-based triage over telemetry) flagged it first. Nice.

It is not yet known what LLM the adversary used, but Hugging Face wrote that the agent seems to have been built on top of an open-source research agent.

Hugging Face identified and fixed the root cause, eradicated the attacker’s foothold, and rebuilt impacted systems. They also recommend rotating creds and reviewing activity on your account.

Video Walkthrough

Here is a video where I talk about this security incident in more detail:

The Asymmetry Problem

The most significant lesson from the incident in my opinion is this part:

Hugging Face needed to analyze the attacker’s actions (like commands, exploit payloads, credentials, and C2 artifacts,…), and they initially tried to use frontier models behind commercial APIs, but provider safety guardrails repeatedly blocked the forensic workload.

This creates a challenge for defenders. Hugging Face eventually pivoted to GLM 5.2, a Chinese open-weight model, and ran it on their own infrastructure. The local model allowed the team to continue analyzing the intrusion, presumably because it has less aggressive safety guardrails.

Local execution also ensured that attacker data and the credentials referenced in the logs never left Hugging Face’s environment.

Lack of IOC Sharing

Hugging Face says its analysis reconstructed the intrusion timeline and extracted indicators of compromise.

But the public disclosure currently contains no actionable indicators to hunt for: no payload hashes, C2 domains, malicious dataset identifiers, or detection rules.

Hugging Face writes that an external forensic investigation remains ongoing, and law enforcement was contacted as well. So, I assume we will hear more down the road, and to be fair it seems like the intrusion just happened recently.

Key Takeaways for Defenders

Autonomous Intrusions Are Operational: AI-driven operations are now capable of compromising and navigating production environments, harvesting credentials, and performing lateral movement.

Safety Guardrails Can Block Incident Response: Security workflows that depend on commercial AI APIs may become unavailable mid-incident.

Maintain an Independent Forensic Fallback: Until commercial AI labs adjust their safety guardrail stance to reliably support defenders, it is probably a good idea to vet and stage a locally deployable open-weight model before an incident occurs, not during one. That should maybe even be the default. If you have an enterprise account, it’s probably worth discussing this challenge with your account manager. The current state is suboptimal. I say suboptimal also because running a model with less safeguards, also means that attacks like indirect prompt injections might succeed more likely.

Incident Disclosures Must Be Actionable: When IOCs are not shared, disclosures provide less value and defenders are left wondering.

Rotate Your Tokens and Review Activity: Hugging Face recommends “rotating any access tokens and reviewing recent activity on your account”.

Conclusion

The era of operational AI-driven intrusions is here.

Attackers no longer necessarily need a human operator at the keyboard throughout an intrusion. Autonomous frameworks execute substantial parts of the attack lifecycle, adapt to failures, and operate at “machine speed”.

The Hugging Face intrusion also shows that simply adding more AI to the defensive side is not enough. Hosted-model guardrails can obstruct legitimate forensic work.

As I have said in many of my presentations, the exploits and TTPs will be quite familiar at first, but the velocity and scale of agentic adversaries is something defenders need to adapt...