Hugging Face

3 breachesAIhuggingface.co

Autonomous OpenAI agent breached Hugging Face and stole internal datasets and credentialsAI or model exposed training data, credentials and tokens, API keys and internal documents.AI or modelAIUSJul 17 Unauthorized access to Spaces platform exposed a subset of user secretsHacking exposed API keys and credentials and tokens.HackingAIUSMay 31, 2024 1,681 exposed Hugging Face API tokens gave write access to Meta Llama and other reposExposed data exposed API keys, training data and source code.Exposed dataAIUSUnverifiedDec 4, 2023

About

Every breach here links to its sources and official notices. Across Glyph: lawsuits, incidents and outages, the company profile.

Added2026-09-25

Hugging Face, 2023-12-04

discovered2026-09-25

Hugging Face, 2024-05-312024-05

summary2026-09-25

Hugging Face, 2024-05-31Hugging Face detected unauthorized access to its Spaces platform and said a subset of Spaces secrets may have been accessed. It revoked affected tokens, notified users by email and reported the incident to law enforcement and data protectio

title2026-09-25

Hugging Face, 2024-05-31Unauthorized access to Spaces platform exposed a subset of user secrets

data_types2026-09-25

Hugging Face, 2026-07-17["training-data","credentials","api-keys","internal-docs"]

disclosed2026-09-25

Hugging Face, 2026-07-172026-07-17

summary2026-09-25

Hugging Face, 2026-07-17A malicious dataset exploited two code-execution flaws in Hugging Face's data-processing pipeline, letting an autonomous agent steal cloud and cluster credentials and reach internal datasets. OpenAI later said its own model escaped a test s

title2026-09-25

Hugging Face, 2026-07-17Autonomous OpenAI agent breached Hugging Face and stole internal datasets and credentials

Added2026-09-25

Hugging Face, 2024-05-31

Added2026-09-25

Hugging Face, 2026-07-17