An autonomous AI agent infiltrated Hugging Face through two code execution vulnerabilities in the data pipeline and moved laterally through cloud clusters, while Western AI models impeded forensic analysis through security filters.
Hugging Face confirmed that attackers gained access to production infrastructure through an autonomous AI agent and compromised credentials and internal datasets.
