A Look Inside the Hugging Face Breach

Varonis security brief On July 16, 2026 , Hugging Face disclosed a security breach in which an autonomous AI attacker infiltrated its internal infrastructure. The attacker chained two remote code execution (RCE) vulnerabilities in Hugging Face’s dataset processing pipeline, leaked cloud and cluster credentials, moved laterally into internal clusters, and even generated decoy activity to slow investigators down. Hugging Face caught it with its own AI : an anomaly-detection pipeline that uses LLM-based triage to correlate security telemetry.