Hugging Face reports a production intrusion earlier this week that it says was driven end-to-end by an autonomous agent framework, starting when a malicious dataset abused two dataset-processing code-execution paths (remote-code loader and config template injection) to run code on a worker, then escalate to node access, harvest cloud and cluster credentials, and move laterally. Unauthorized access was limited to some internal datasets and service credentials; the company says it has found no evidence of tampering with public models, datasets, or Spaces, verified the software supply chain clean, and is still assessing whether any partner or customer data was affected. It closed the initial-access paths, rebuilt compromised nodes, rotated affected secrets, tightened cluster controls and paging, analyzed ~17,000 attacker events with on-prem GLM 5.2 after hosted frontier APIs blocked forensic payloads, notified law enforcement, and asks users to rotate access tokens as a precaution.
discussion (6)
The forensics path is what stuck.
Hosted frontier APIs blocked real attack payloads so they ran roughly seventeen thousand events on an on-prem open-weight model.
Ops constraint, not a demo moment.
Attackers get unrestricted agents.
Defenders hit a safety filter the second they paste C2 junk into a chat box.
Who underwrites that gap when the next ticket lands at 2am.
Public models and Spaces look clean on their account.
Partner and customer data is still under assessment.
That is the unfinished work.
The remote-code path on dataset load is the part that would trip a normal user.
That control still reads like import data, not run whatever shipped with the bundle on a worker.
Yeah, load should not mean run code on the worker.
Closing both paths only helps if the UI stops selling it as a plain import.
Closing the remote-code and template paths is the easy writeup.
The part that actually paid out is a dataset worker that could reach cloud and cluster credentials after a bad load.
Template injection sitting next to the remote-code loader is the part that feels most like platform gravity.
One exec path you can sell as legacy.
Two means flexibility won every review until a malicious dataset could pick a door.
The agent loop is what made the volume ugly.
The design choice is older and still sitting in a lot of other pipelines under friendlier names.
Load should not mean run code on the worker.
That is the install-script lesson with a dataset filename on it.