Hacking AI: Hugging Face Breach Exposes Internal Data

A vulnerability in Hugging Face's security allowed attackers to access the company's internal systems and steal sensitive data.

Hugging Face, a platform that hosts AI models and datasets, has confirmed a breach that affected its internal datasets and credentials. The company disclosed the breach on Friday, but said it was still investigating whether any customer or partner data was stolen during the incident.

According to Hugging Face, a dataset uploaded to its platform abused a security vulnerability to run malicious code on its servers. This allowed the attackers to escalate their permissions and gain broader access to Hugging Face's internal systems.

The breach highlights the challenges that companies like Hugging Face face when hackers try to abuse platforms and tools to access and steal sensitive data from within.

Hugging Face has revoked and rotated the stolen credentials that were accessed. The company is urging users to do the same with any keys stored on the platform and review any suspicious activity on their accounts.

In a blog post, Hugging Face said it has fixed the vulnerability that was abused during the cyberattack. However, the company did not immediately provide evidence for its claim that the breach was caused by an external AI agent.

Hugging Face blamed the breach on an external AI agent that executed 'many thousands of individual actions' across a swarm of short-lived sandboxes.

The company said its own anomaly detection spotted the attack, and used an AI model to analyze server logs that kept record of the cyberattack.

Hugging Face has reported the incident to law enforcement and roped in cybersecurity forensic specialists to investigate the breach and review its security.

The breach underscores the challenges that companies like Hugging Face face when hackers try to abuse platforms and tools to access and steal sensitive data from within.

Hugging Face's incident highlights the importance of robust security measures and the need for companies to stay vigilant in the face of evolving threats.

The company's response to the breach also raises questions about the use of AI models in cybersecurity and the need for better collaboration between companies and law enforcement.

In a statement, Hugging Face said it is committed to protecting its users' data and will continue to work to prevent similar incidents in the future.