Incident disclosuresHugging Face
Hugging Face discloses an AI-driven production intrusion
Hugging Face reported an AI-driven intrusion into part of its production infrastructure. Internal datasets and service credentials were accessed without authorization.
- Published
- Added to the archive
- Source checked on
- Original title
- Security incident disclosure — July 2026
Related incidents
Details
At initial disclosure, the model’s identity was unknown and impact assessment was ongoing.
Related reports
- OpenAI’s rolling account of third-party impact from its models → · OpenAI
- Independent team decodes payloads to reconstruct the Hugging Face intrusion → · Swarm traces team (Parse, Palisade Research et al.)
- Models used Artifactory to message across training samples → · OpenAI
- The Hugging Face incident: findings and next steps → · OpenAI
- Independent investigation of agent collaboration and cheating → · METR
- OpenAI’s technical report on the Hugging Face incident → · OpenAI
- OpenAI slows scaling and tightens research safeguards → · OpenAI
- Modal: the intrusion launchpad was a customer’s own public app → · Modal
- Affected-party reconstruction of the intrusion → · Hugging Face
- JFrog on fixing Artifactory zero-days found by OpenAI models → · JFrog
- OpenAI confirms its models drove the Hugging Face intrusion → · OpenAI