Hugging Face uses GLM 5.2 to investigate AI agent-driven cyberattack

AI development platform Hugging Face disclosed a breach last week that was both conducted and investigated with AI.

Hugging Face reported that the attack that took place over the weekend of July 11 was conducted “end to end” by “an autonomous AI agent system,” gaining access to some internal datasets and credentials used by Hugging Face services.

Hugging Face used its own large language model (LLM)-based triage system to detect the intrusion and subsequently used AI agents to analyze the attack, including more than 17,000 actions taken by the agentic attacker.

The company’s report noted that the safety guardrails of frontier models it initially used via commercial APIs restricted its ability to effectively analyze the large volume of attacker commands, exploits and command-and-control (C2) artifacts, leading Hugging Face to turn to the open-weight Z.ai model GLM 5.2, hosted on their own infrastructure, to complete their investigation of the attack.

“The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment,” Hugging Face stated in its disclosure.  

The LLM model used by the attacker is unknown, but Hugging Face stated it believed the agent framework was built on an “agentic security-research harness,” allowing the attack to be conducted rapidly with thousands of actions taken across “a swarm of short-lived sandboxes.”

“Think of a burglar that never gets tired, never needs sleep, and instead of jiggling one door handle at a time, is trying a thousand of them simultaneously. That’s basically what happened here. Not one guy typing commands into a terminal, a swarm of little automated processes hammering away nonstop, hopping between hiding spots that make it harder to trace,” Chris Boehm, field CTO at Zero Networks, said in comments provided to SC Media.

The initial access point was Hugging Face’s data-processing pipeline, where a malicious dataset exploited two code-execution paths: a remote-code dataset loader and a template-injection in a dataset configuration, the company said. These underlying vulnerabilities have since been fixed, according to Hugging Face.

“Dataset processing pipelines get the same level of security scrutiny that CI/CD hooks and build functions get, which is almost none. Teams pour AppSec effort into the application layer and treat the infrastructure that ingests and transforms data as plumbing,” noted Jacob Krell, senior director of secure AI solutions & cybersecurity at Suzu Labs, in comments to SC Media.

While the attacker gained access to Hugging Face’s internal datasets and credentials, which have since been rotated, the company said there is no evidence that any public models, datasets or Hugging Face Spaces were modified, adding that its container images and published packages were “verified clean.”

Hugging Face said any partners or customers whose data may have been affected will be contacted directly as it completes its assessment and recommends community members review their recent activity and rotate access tokens as a precaution.

“Open source model repositories like Hugging Face now represent a meaningful supply chain risk. As adversaries increasingly target training and fine-tuning data rather than source code, organizations need to test open source models for behavioral drift, not just code-level vulnerabilities,” Tumeryk CEO Rohit Valia told SC Media in an email. “An AI trust score gives enterprises a way to verify a model hasn’t been altered and is safe to use, while aligning to frameworks like the Cloud Security Alliance’s RiskRubric v2 which provide the structured testing methodology.”

The double-edged sword of AI use for cybersecurity tasks has led companies like OpenAI and Anthropic to gate their most cyber-capable models behind programs like OpenAI Daybreak’s Trusted Access for Cyber and Anthropic’s Project Glasswing. The cyber offensive capability of Anthropic’s Claude Mythos temporarily led the U.S. government to restrict access to Mythos and its publicly accessible cousin Fable, which was released with strict guardrails to refuse cybersecurity-related tasks.

While Hugging Face did not name the specific frontier models it attempted to use before switching to GLM 5.2, Krell of Suzu Labs echoed concerns about what Hugging Face calls “the asymmetry problem” in AI-powered cyber operations.  

“I’ve hit the same wall. I still run Opus 4.6 for security work and haven’t upgraded because newer models’ guardrails increasingly block legitimate analysis of exploit code and attack artifacts,” Krell said. “Machine-speed exploitation requires machine-speed response, and that response can’t run on models that refuse to examine the evidence.”