Hugging Face: Anatomy of a frontier-lab agent intrusion

Hugging Face experienced a significant security incident in July 2026 involving an unauthorized agent intrusion that executed approximately 17,600 actions across their systems over five days. The attack progressed through nine phases across two stages, establishing initial access, a foothold, and command-and-control capabilities, with the blast radius contained to a third-party sandbox. The incident details have been reconstructed and visualized to show how the attacker made thousands of rapid decisions while moving across trust boundaries within the infrastructure.