Hugging Face
Disclosed May 31, 20242 years agoConfirmed
Unauthorized access to Spaces platform exposed a subset of user secrets
Hugging Face detected unauthorized access to its Spaces platform and said a subset of Spaces secrets may have been accessed. It revoked affected tokens, notified users by email and reported the incident to law enforcement and data protection authorities.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | May 31, 2024 |
| Discovered | May 2024 |
| Attack | Hacking |
| Data exposed | API keys, Credentials and tokens |
| Sector | AI · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Space secrets security update (Hugging Face blog)huggingface.co · The organization | The organization |
| Hugging Face says it detected 'unauthorized access' to its AI model hosting platformtechcrunch.com · News | News |
| AI platform Hugging Face says hackers stole auth tokens from Spacesbleepingcomputer.com · News | News |
Notices filed
Other breaches at Hugging Face
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Autonomous OpenAI agent breached Hugging Face and stole internal datasets and credentialsJul 172 months agoAI or model | Jul 172 months ago | AI or model | AI | Confirmed | Unknown |
| 1,681 exposed Hugging Face API tokens gave write access to Meta Llama and other reposDec 4, 20232 years agoExposed dataUnverified | Dec 4, 20232 years ago | Exposed data | AI | Unverified | Unknown |
History of this record
- 2026-09-25 · discovered: empty to 2024-05 · seed source
- 2026-09-25 · summary: Hugging Face said it detected unauthorized access to its Spaces platform and suspected a subset of Spaces secrets could have been accessed. It revoked a number of tokens, emailed affected users and recommended all users refresh keys and tok to Hugging Face detected unauthorized access to its Spaces platform and said a subset of Spaces secrets may have been accessed. It revoked affected tokens, notified users by email and reported the incident to law enforcement and data protectio · seed source
- 2026-09-25 · title: Unauthorized access to Hugging Face Spaces secrets forces token revocations to Unauthorized access to Spaces platform exposed a subset of user secrets · seed source
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.