AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Hugging Face confirms breach affected internal datasets and credentials, urges users to take action

highnews

securityprivacy

Source: TechCrunch (Security)July 20, 2026

Summary

Hugging Face, a platform hosting AI models and datasets, disclosed that attackers exploited a security vulnerability to run malicious code on its servers, compromising internal datasets and service credentials (codes that prove identity and grant access to systems). The company has fixed the vulnerability and revoked the stolen credentials, while urging users to rotate their own keys and review account activity for suspicious behavior.

Solution / Mitigation

According to the source, Hugging Face has taken these steps: (1) revoked and rotated the stolen credentials that were accessed, (2) fixed the vulnerability that was abused during the cyberattack, and (3) urged users to 'do the same with any keys stored on the platform, and review any suspicious activity on their accounts.' The company also reported the incident to law enforcement and engaged cybersecurity forensic specialists to investigate.