It appears that hackers are now using AI agents to launch attacks. On July 16, open-source model hosting provider Hugging Face released a blog post claiming its production infrastructure had been compromised by an autonomous AI agent.

The company said the attack was perpetrated by an autonomous agent framework, built on top of an agentic security research harness powered by an unknown LLM . During the incident, the agent is said to have executed thousands of individual actions across a “swarm” of sandboxes, resulting in unauthorized access to internal data sets and service credentials.

The open-source model provider, which is home to 2 million public models, 13 million users and over 30 percent of the Fortune 500 , notes that the intrusion began when a malicious dataset abused two code execution paths to run code on a processing worker. After obtaining initial access, the agent escalated to node-level access, harvesting cloud and cluster credentials before moving into several internal clusters.

Following the breach, Hugging Face is investigating whether the breach impacted customer or partner data. If the company is correct in its assessment that the breach was led by an AI agent, it would suggest the era of the “agentic attacker” isn’t just a theoretical possibility but something that threat actors are actively exploiting.

Introducing The Agentic Attacker

Across the cybersecurity industry, anxiety over the exploitation of frontier AI models has been at fever pitch, particularly following Anthropic’s announcement of Claude Mythos Preview in April. Anthropic introduced Mythos to the world as an AI model capable of finding thousands of vulnerabilities in every major operating system and web browser.

Immediately, the company launched Project Glasswing, bringing together companies including AWS, Apple, Cisco, CrowdStrike, Microsoft and Palo Alto Networks, to try and help find ways to secure critical software before malicious actors got access to these powerful offensive capabilities.

Project Glasswing gave a perception that defenders would have a brief window to strengthen their defenses before the offensive capabilities of Mythos or equivalent models were available to the public. If the incident was conducted by an agent as Hugging Face claims, it would suggest more powerful autonomous attacks are coming to the threat landscape, and that frontier AI vendors’ guardrails are woefully unprepared.

Following the incident, I reached out to HuggingFace for comment, and Clement Delangue, co-founder and CEO, told me via email, “This incident confirms what many of us expected: attackers are already using AI agents, and that won't be stopped by locking models behind APIs.”

It’s worth noting that during the breach, the company input large volumes of real attack commands into a frontier LLM. The LLM’s content moderation guardrails blocked the requests, demonstrating that it couldn’t distinguish between legitimate incident response and malicious activity.

“Determined attackers bypass guardrails; it’s defenders who lose out when they can't inspect, test, and run models on their own infrastructure. That's why we see open-source models not as a cybersecurity risk but as a necessity for defense: attackers already have their tools, and open models are how defenders get theirs,” Delangue said.

As part of its incident response process, Hugging Face opted to fight AI with AI, using an LLM to analyze the full attacker action log across more than 17,000 recorded events. Using AI in this context enabled the company to reconstruct the incident timeline, extract indicators of compromise and map the impacted credentials, condensing an investigation that would usually take days into hours.

After the aforementioned AI model’s guardrails refused to assist with incident response, the team turned to GLM-5.2, an open-weight model developed by Chinese AI startup Z.ai . Hugging Face ran the model on its own infrastructure to conduct forensic analysis and then closed the vulnerability gained to gain access to the environment, revoking and rotating affected credentials and tokens.

“Taking Hugging Face’s disclosure at face value, they explicitly highlighted how the data breach was primarily executed using an autonomous agent that could self-migrate and manufacture deliberate decoy noise. From their side, they were equally dependent on their own AI-driven analysis to even have a chance of keeping pace,” Seva Ioussoufovitch, senior research analyst of security and privacy at Info-Tech Research Group, told me via email.

“What’s particularly noteworthy, is that they had to fall back to an open-weight model to do so, because the safety guardrails on their frontier model’s provider blocked their own analysis attempts,” Ioussoufovitch said. He added that the incident highlights the fragility of security operations that rely on well-known frontier models.

Attackers Move At Machine Speed

As frontier and open source models become more advanced, defenders need to prepare for a world in which threat actors have access to ever more powerful offensive capabilities. Indeed, there are already signs that threat actors are weaponizing these tools.

ThreatDown today released its 2026 Cybercrime in the Age of AI Report and found that malicious AI models are widely available, with researchers identifying 6,644 AI models published openly on Hugging Face under labels including ‘abliterated,” “uncensored,” “decensored,” “heretic” and “unfiltered.”

These models would perform requests that mainstream AI models would refuse and have been downloaded more than 22 million times. This indicates that malicious entities have access to a wide variety of permissive models which they can use to attack organizations.

“AI is changing the economics of cyber operations. Whether attackers are using autonomous AI systems, AI-assisted tooling, or automating specific parts of an intrusion, the result is the same. Sophisticated activity can become faster, more scalable and accessible to a broader range of threat actors,” Joseph Perry, cybersecurity researcher and advanced services lead at cybersecurity and consulting firm Arcova, told me via email.

What’s Next For Defenders

With attackers leveraging AI to conduct cyber attacks, defenders must begin to move at machine speed if they want to keep up. Hugging Face was able to respond to the breach by using AI to expedite the investigation process. Without that, the remediation effort would have taken significantly longer.

“The lesson for the industry is that defense needs to become agentic too. AI helped us detect and respond to this faster than a purely human team could have, and we think that pattern will define the next few years of security,” Delangue said.

Beyond patching software to prepare for the day Mythos-level models are out in the wild, organizations need to double down on incident response capabilities, leveraging AI to detect and contain breaches as fast as possible.

As Ioussoufovitch suggests, the breach indicates the competent use of AI in the SOC will soon become a “table-stakes necessity” for effective defence, rather than a high-maturity signal.

Above all, organizations shouldn’t assume that frontier AI models like Mythos or GPT-5.5 Cyber will be fully prepared to take on incident response. Diana Kelley, CISO at unified security and governance platform Noma Security, argues that until frontier model providers can distinguish authorized defensive work from abuse, “CISOs that want to use AI for incident response should have a vetted self-hosted model available as a backup option."

"That gives security teams a way to continue analyzing attack artifacts when hosted models block the content, while keeping sensitive artifacts and credentials inside the enterprise environment,” Kelley said.

In any case, even the most competent security teams will have to navigate an asymmetry in the threat landscape, where attackers can exploit powerful AI models with techniques like jailbreaks, while defenders are constrained by content moderation guidelines.