Original article posted here. 

The AI platform says attackers turned a malicious dataset into an entry point for stealing credentials and moving through its internal systems. The incident raises new questions about AI supply chain security, autonomous hacking tools, and whether defenders can keep pace with machine-speed attacks.

Hugging Face has disclosed a cybersecurity breach that exposed internal datasets and service credentials after attackers allegedly weaponized a dataset uploaded to its widely used artificial intelligence platform.

****

“This incident should be a wake-up call, not because AI was involved, but because it shows how fast AI-native attacks are outpacing security programs,” said Gidi Cohen, CEO and co-founder of Bonfy.AI.

“An autonomous agent didn’t use fancy tricks, it just exploited familiar gaps in the system like code execution paths, credentials, and lateral movement. The difference is speed. Thousands of coordinated actions across short-lived environments shrank the response window from days to hours.”

Many security programs still depend on alerts being reviewed sequentially by human analysts. An automated attacker can generate thousands of events, create disposable infrastructure and alter its behavior faster than a conventional response team can reconstruct the timeline.

Cohen said that imbalance becomes more dangerous when defenders rely on AI services they do not fully control.

“The bigger issue is defense. Hugging Face found its own response constrained by model guardrails. This s a new imbalance we see everywhere: the attacker operates without limits, while defenders (security personnel or security platforms) rely on tools that can refuse to help. If your company's response tech stack isn’t fully under your control, your security posture isn't either.”

Read the full article here.