HF 7/16 security incident disclosure: first publicly disclosed end-to-end autonomous AI agent intrusion + zai-org/GLM-5.2 triage + seven remediations

Hugging Face's July 16, 2026 blog discloses an intrusion into part of HF's production infrastructure driven end-to-end by an autonomous AI agent system: the attacker exploited code-execution paths in dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker, escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. The campaign was executed by an autonomous agent framework running many thousands of individual actions across a swarm of short-lived sandboxes. Disclosed impact: unauthorized access to a limited set of internal datasets, compromise of several credentials used by HF services, no evidence of tampering with public user-facing models / datasets / Spaces, and software supply chain (container images and published packages) verified clean. HF used zai-org/GLM-5.2 on their own infrastructure for LLM-based triage, analyzing over 17,000 recorded events — frontier models behind commercial APIs had blocked their requests due to safety guardrails that couldn't distinguish a responder from an attacker. Seven remediations: fixed root vulnerability, eradicated attacker foothold and rebuilt compromised nodes, revoked/rotated affected credentials and tokens, deployed additional guardrails and stricter cluster admission controls, improved detection/alerting (high-severity signals page responders in minutes), engaged outside cybersecurity forensic specialists, reported to law enforcement. Community advisory: as a precaution, rotate access tokens and review recent account activity.