Hugging Face Discloses First Known End-to-End Cyberattack Carried Out by an Autonomous AI Agent

Hugging Face said an autonomous AI agent system executed an end-to-end intrusion against part of its production infrastructure, marking what the company describes as the first publicly documented cyberattack conducted entirely by an agentic AI. In a security disclosure published July 16, 2026, the AI model-hosting platform detailed how the machine-driven attacker breached its systems by abusing weaknesses in its data-processing pipeline, then escalated privileges and moved laterally across internal clusters over the course of a weekend.