On July 16, Hugging Face disclosed a compromise affecting part of its production infrastructure. The initial entry point was a malicious dataset, while the subsequent intrusion was, according to the company, carried out by an autonomous agent framework. Attack Chain The dataset abused two code-execution paths: a remote-code dataset loader and template injection in a dataset configuration. Code ran on a processing worker, after which the attacker obtained node-level access,...