HuggingFace hacked: How RCE Dataset Loader exploited AI playground

This is what is going on in the supply chain for AI: the very thing that we all generally think of as a passive item, a dataset, a folder full of information stored on a server, can actually be the mechanism that allows for code execution. That is what recently occurred at Hugging Face, and it should scare everyone who brings datasets into their pipelines without further consideration.

Survey

Also read: Rise of Friendslop games: Best couch co-op games you need to try

Hugging Face noticed and responded to an intruder accessing certain parts of their production infrastructure, calling the attack different in kind than others in that it was driven by an autonomous AI agent system, end to end, detected mainly through Hugging Face’s own AI tools. They say there was unauthorized access to a certain number of internal datasets and credentials associated with their services, and are evaluating the extent to which partner or customer data was compromised. Their public models and Spaces remained intact.

What is most interesting about this attack vector is the entry point. This breach began when a malicious dataset leveraged two methods of executing code – a dataset loader with remote code execution capabilities and the template injection vulnerability in the dataset configuration – to execute code in the processing worker. After that initial foothold, the attacker used the node access gained to escalate privileges to steal cloud and cluster credentials and move horizontally across multiple internal clusters in less than a week’s time.

Simplistically, a dataset loader is simply a tool that takes a dataset, loads it, and then prepares it for use by the model. However, certain loader tools have the capability to run scripts that have been bundled along with the dataset. While convenient, this capability is also the attacker’s avenue of entry. Since the loader is going to run any kind of code to prepare the dataset, the dataset itself ceases to be just the dataset. It becomes a payload delivered through a delivery method that trusts it implicitly. The template injection attack adds to this issue by allowing the attacker to sneak in malicious code within an apparently harmless configuration file.

Also read: Netflix used generative AI on 300 titles this year, and there’s no rulebook

What made this event exceptional is not just the incident report but also who exactly was responsible for it. The attack was perpetrated by an autonomous agent architecture, most likely based on an agentic security research harness, performing thousands of separate actions through a swarm of short-lived sandboxes, with self-migrating command-and-control being performed via public services. Hugging Face refers to this scenario as the “agentic attacker” that the industry had long anticipated, and the only thing I would disagree with here is in considering this threat novel just because it uses a different approach to credential harvesting and lateral movement. 

In fact, there is an exceptionally awkward part of this story. When trying to analyze 17,000+ logged actions of the attacker by utilizing frontier models available through commercial APIs, safety guardrails on the APIs prevented the analysis because of the nature of the request involving exploitation of a real attack. As a result, Hugging Face had to resort to analyzing the data with a general purpose model called GLM 5.2 running on their own infrastructure.

This is a truly valuable, albeit somewhat ironic, lesson for defenders around the world, since the same safety rail designed to protect against misuse can end up stopping defenders in their tracks too. As Hugging Face recommends, you should be prepared in advance by deploying a capable, self-hosted model before the event takes place.

From a developer/AI team standpoint for those routinely using datasets from Hugging Face, it is important to note that this is a lesson in good coding practices rather than a cause for panic. It is crucial to treat Hugging Face data loader in the same manner that you would any untrusted third-party code. Also, do not assume that “it’s only a dataset,” therefore there is no problem.

Also read: What is Kimi K3: Moonshot’s frontier AI model that matches Claude Opus 4.8 and GPT 5.5

Vyom Ramani

A journalist with a soft spot for tech, games, and things that go beep. While waiting for a delayed metro or rebooting his brain, you’ll find him solving Rubik’s Cubes, bingeing F1, or hunting for the next great snack. View Full Profile