A Malicious Dataset Was All It Took for an AI Agent to Reach Hugging Face's Internal Clusters

The entry point was ordinary: a dataset that, once processed, could trigger its own code. Hugging Face traces the intrusion to two separate weaknesses in how its pipeline handles incoming datasets, one that let a dataset's loading logic execute arbitrary code and a second where a dataset's configuration file could inject commands through a template engine. Either flaw alone was enough to get a foothold on a single processing worker over a weekend before the disclosure; together, they gave whoever built this operation two independent ways in. Hugging Face disclosed the incident on July 16 and has since closed both paths. Hugging Face →

What happened after that single foothold is the more striking part. One compromised worker yielded credentials for Hugging Face's own cloud accounts and internal cluster systems, and those credentials became the bridge into several other parts of the company's internal infrastructure — the classic shape of a lateral-movement intrusion, except the operator wasn't a person. Hugging Face describes an autonomous agent framework driving the entire operation, spinning up disposable sandbox environments by the thousand and relocating its own command-and-control channel across public infrastructure as it worked, leaving a forensic trail of more than 17,000 logged actions by the time the company's team caught up with it.

Hugging Face's own account draws a clear line around what it can and can't confirm. On the confirmed side: a defined set of internal datasets was reached, along with a number of internal credentials, and nothing public-facing — models, datasets, or Spaces that customers actually use — shows signs of tampering. On the unconfirmed side: the company has not named who built or ran the agent, nor which underlying model gave it its reasoning capability. That gap is itself the story. An intrusion this automated doesn't need a skilled human behind the keyboard for every decision, which makes attribution and motive far harder to pin down than in a conventional breach.

This is the second confirmed autonomous-agent intrusion Hardened has covered in just over two weeks, after Sysdig's JadePuffer ransomware capture. The pattern in both cases is the same: a single conventional vulnerability gets an agent through the door, and from there the agent's ability to reason, retry, and adapt does the rest of the work a human operator used to have to do by hand. That shifts the calculus for any organization defending infrastructure that hosts or processes untrusted data.

If your organization ingests datasets, models, or other content from external or user-supplied sources into an automated pipeline, the question isn't whether that pipeline could be tricked into executing code — it's whether you'd notice thousands of small, individually unremarkable actions happening across it before an agent reached something that mattered. Ask your team this week whether any data-processing pipeline you run treats external dataset content as pure data, or whether any part of it can be coaxed into executing instructions.

On July 15, the Canadian Centre for Cyber Security published Alert AL26-017, covering three critical Microsoft SharePoint Server vulnerabilities: CVE-2026-58644 (deserialization of untrusted data, remote code execution), CVE-2026-56164 (missing authentication, privilege escalation), and CVE-2026-55040 (weak authentication, security-feature bypass). Microsoft shipped fixes for all three in its July 14 Patch Tuesday release, and CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalogue on July 16 based on confirmed active exploitation. Researchers describe attackers chaining CVE-2026-56164 with older SharePoint weaknesses to steal IIS machine keys and establish persistence — the same mechanical fingerprint as the July 2025 ToolShell campaign, in which nation-state and ransomware actors exploited SharePoint across finance, healthcare, government, and energy organizations. CCCS → The Hacker News →

SharePoint Server sits behind HR portals, procurement systems, and internal document repositories across federal, provincial, and municipal government in Canada, as well as regulated sectors including finance and healthcare. A ToolShell-pattern attack chain against that footprint is a board-level question about patch cadence, not just an IT ticket.